- cypherpunks-legacy - lists.cpunks.org

Banks eyeball sci-fi style identification for ATMs
by an215712＠anon.penet.fi 17 Dec '03

17 Dec '03

Date: Sun, 24 Sep 1995 10:20:05 PDT NEW YORK (American Banker) - Biometric identification, a process formerly seen only in futuristic movies and high-security government offices, may soon become part of the most common consumer banking transactions. Bankers' interest in biometric ID -- a sophisticated antifraud measure that exploits the fact that every human possesses unique physical characteristics -- dates back more than a decade. But until recently most banks and equipment manufacturers have watched the development of technology that recognizes fingerprints, voices, and other personal traits from a distance. That has begun to change, experts said. One of the companies leading the charge toward everyday use of biometric identification in banking is Sensar Inc., a Princeton, N.J.-based company that is developing an automated teller machine application for its patented Iriscan process. According to experts, the eye is one of the most unique parts of the human body and the iris biometric more reliable than virtually any other, including fingerprints and voice. Voices change over the course of a life, and fingerprints sometimes disappear on people who work with their hands. By contrast, the iris, which is the colored area of the eye, is stable throughout a lifetime. They are thoroughly unique and naturally visible. In a nutshell, the company's product, to be sold under the name Irisident, is being designed to capture an image of a consumer's eye and match it to an image on file before authorizing an ATM transaction. ``The research that's been done with consumers indicates they like the idea of having biometric verification -- it gives them a feeling of greater security,'' said Liam Carmody, a principal with the Ridgewood, N.J.-based consulting firm Carmody & Bloom. ``But they don't want intrusive verification.'' Sensar officials understand that the use of the eye as an identification tool is likely to meet with skepticism from some bankers, who wonder whether consumers will rebel against it. However, they said their ATM application -- which should be available in prototype in the next few months -- is being designed to address the consumer concerns. And they insist that Irisident products will be of practical use to bankers. ``We are operating under the assumption that the consumer is not going to put his eye up to something to be scanned,'' said Kevin McQuade, vice president of strategic business development at Sensar. ``The breakthrough here is the ability to obtain the image of the eye unintrusively,'' said Thomas Drury, president and chief executive of Sensar, which is a unit of the David Sarnoff Research Center Inc., also based in Princeton. Several influential companies have committed money to the development of an ATM application for Sensar's technology, including Huntington Bancshares Inc., OKI Electric Industry Ltd., and a money-center bank that does not want to be identified. Though the bankers declined to discuss their investment in the project, OKI Electric has committed a minimum of $25.8 million for development funding in return for the exclusive rights to market the products in Japan, where the Tokyo-based company is the leading vendor of ATMs. Experts said this support shows that the financial services industry is looking for alternatives to the personal identification numbers and computer passwords that have been compromised with increasing frequency in recent years. The choices are many, and include fingerprints, on-line signature verification, and even the measurement of facial thermal zones. ``Bankers are interested in alternatives to the PIN,'' said V. John Stroia, a marketing manager with Diebold, Canton, Ohio. Diebold and IBM operate an ATM joint venture known as InterBold. ``The major barrier is not so much the technology as getting the customer acclimated to'' using biometric technologies. But, he added, capturing sensitive biometric data -- such as that from the eye or face -- ``is going to have to be covertly done.'' ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

weak links in DigiCash system
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jerod, I'm forwarding your message to a couple of lists. I thought you made good points. Of course DigiCash is only running a demo, but still-- why demo poor security? I think it doesn't make a good impression. Bryce, signatures at end - ------- Forwarded Message To: ecash-feedback(a)digicash.com cc: netherto(a)taussky.cs.colorado.edu, wilcoxb(a)taussky.cs.colorado.edu Subject: Security in your ecash project. Date: Tue, 26 Sep 1995 17:00:15 -0600 From: Jerod D Netherton <netherto(a)taussky.cs.colorado.edu> I have a couple of problems/complaints with your ecash project. When I was sent my Acct ID and Passwd they were sent to me plain text instead of being PGP-encrypted first. This means that some malicious hacker could have intercepted the e-mail message and stolen the free cyber-bucks you were so generous as to give me. Second, on the WWW-page where one downloads the software it does not seem to do a secure connection between my browser and your server (on netscape there is a small key in the lower-left hand corner that is supposed to show when one is securely connected to a secure server). So someone could sniff my password from the transaction when I GET the software. Also When I'm buying/selling things it would be smart for all parties involved to be using PGP, and I think you should stress this point more in your page. Otherwise this is another vulnerable point in your system IMHO. Thank you for your time. /\ The Scottish Claymore of All CyberSpace UgradLab DumpMeister /\ Watcher of Anime. Addictor to Muds. WebMaster of OAA at CU! < E A N O R JaDuN Comes. Shade and Sweet Water \/ Yuri, Miyu, Nene, Ranma-chan, Ryoko, B-ko! \/ Anime, Chivalry, and Physics Forever!!!! Finger for PGP Key Email:netherto@colorado.edu Phone:(303)786-8311 Pager:(303)610-1203 http://ugrad-www.cs.colorado.edu/~netherto/Home.html Lab:(303)492-6207 - ------- End of Forwarded Message signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGiNz/WZSllhfG25AQHFMAQApc6Td8e6bQsBqpCU+EnfbYhueJthyYPS rkHfFrenHNwG/MCEFtwXBBxEQP3yyvnY2qD9RrrhC3cN0HcFw2jE8r++2Y3Z9H7u dJuIKodi2LP8POoW6dJPlW93N5E/+LhuCZvfqe78T2bIl20GIYQ5x0UUTm+APo2f MLu6wUEAHTE= =ofwj -----END PGP SIGNATURE-----

1 0

Windows MixMaster Client
by Brian Gorka 17 Dec '03

17 Dec '03

Does anyone out there have a windows mixmaster client? (or a pointer to one?) Also, I am having a LOT of grief trying to get the alpha.c2.org remailer to work for me... (yes, I have the help files) Could someone walk me through it?

2 1

No Subject
by jmotes 17 Dec '03

17 Dec '03

SUBSCRIBE

1 0

CHA_cha
by John Young 17 Dec '03

17 Dec '03

Worth Magazine, October, 1995, has a longish, easy-reading, supportive article on David Chaum and digital cash. Virtually alone among E-money thinkers, Chaum insists on creating anonymity for all transactions -- building a tamper-proof system that works just as "real" cash always has, from cowne shells to $100 bills. The key, he says, is this: Without the spender's say-so, no one should be able to trace who paid whom for what, whether a transaction takes place online or in a swipe of a card at a coffee shop. It's a libertarian approach in tune with Chaum's roots in freewheeling communities such as Berkeley and Amsterdam -- but it is anathema to control freaks like the FBI, the IRS, and corporate information marketers. Chaum says every digital-cash system but his has the potential to be abused or compromised -- and the math seems to bear him out. His competitors, however, insist their plans will prove plenty secure in practice. They dismiss Chaum as an incorrigible purist, a brilliant mathematician and innovator whose political views are hindering his chances of success. Like many in the digital elite, Chaum, an unabashed utopian, does want to create a new world. To him, electronic money is just the first consumer use of an arcane field he hopes will transform society: cryptology, the science of secret codes. In cyberspace, these codes can prove a powerful way of shielding a person's identity -- or of verifying an identity without giving away extra information. Armed with personal computers and good software, says Chaum, ordinary people will finally have the power to do and say things without being tracked by Big Brother. CHA_cha (31 kb in two parts)

1 0

Status of Netscape Bug Exploit (suggestions needed)
by Ray Cromwell 17 Dec '03

17 Dec '03

Ok Folks, here's what I got so far... 1) a URL that can place a specific value in the program counter (gdb) select-frame 2 (gdb) info frame Stack level 2, frame at 0xefbfbc30: eip = 0xefbfbc30; saved eip 0x90909090 ^^^^^^^^^^^^^^^^ called by frame at 0x90909090, caller of frame at 0xefbfbc14 Arglist at 0xefbfbc30, args: Locals at 0xefbfbc30, Previous frame's sp is 0xefbfbc1c Saved registers: eax at 0xefbfbc2c, ecx at 0xefbfbc28, edx at 0xefbfbc24, ebx at 0xefbfbc20, ebp at 0xefbfbc18, esi at 0xefbfbc14, edi at 0xefbfbc10, eip at 0xefbfbc0c, ps at 0xefbfbc08 2) A piece of exploit code on the stack near the PC (gdb) disassemble 0xefbfbc10 0xefbfbc40 0xefbfbc27: nop 0xefbfbc28: nop 0xefbfbc29: nop 0xefbfbc2a: nop 0xefbfbc2b: nop 0xefbfbc2c: nop 0xefbfbc2d: nop 0xefbfbc2e: nop 0xefbfbc2f: nop 0xefbfbc30: nop 0xefbfbc31: nop 0xefbfbc32: nop 0xefbfbc33: nop 0xefbfbc34: nop 0xefbfbc35: nop 0xefbfbc36: nop 0xefbfbc37: nop 0xefbfbc38: nop 0xefbfbc39: nop 0xefbfbc3a: nop 0xefbfbc3b: nop 0xefbfbc3c: nop 0xefbfbc3d: nop 0xefbfbc3e: nop 0xefbfbc3f: nop 0xefbfbc40: nop 3) exploit code that calls the kernel syscall() with SYS_exit (benign exploit, causes your browser to exit) The problem? To make a syscall under BSDI2.0, I have to execute an lcall 0x7,0x0 with 1,0 on the stack. However, to exploit the netscape bug, you can not embed 0x0 in the URL. No problem I thought, I searched Netscape's executable for any kernel calls, and found an lcall 0x7,0x0 at 0x257fee. But I can't do a 32-bit direct jump without a zero, in the instruction (the 32-bit address is 0x00257fee), and I can't do a relative jump from 0xefbfbc30+ If you can come up with some 386 assembly under BSDI2.0 which can invoke syscall() in the kernel without any embeded 0x0 bytes in the code, you can share a Hack Netscape T-Shirt with me. If it turns out to be too hard under BSDI, I'll gladly assist in producing exploits for Windows or another operating system. One trick I thought up for embeding zeros in the code is to self-modify the code using XOR ADDRESS,ADDRESS where ADDRESS is a byte on the stack within the code. Anyone have any better ones? -Ray

1 0

Time Keys, Some Secure Ideas (by Alias: Jay Hyden)
by Anonymous Remailing Service 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Time Keys, Some Secure Ideas << The weakest attack on a time key based system is to spoof the computer that keeps track of time into releasing encryption keys i.e. change the clock. Perhaps this could be avoided by hardware inaccessability, say a computer system taken to, and setup on the Moon by those corporation that are already planning to place VR rovers on the lunar surface. Any Earth bound system would be vulnerable to physical attack. Here are some ideas for such a system: o 7 clocks with absolutely no way of reseting them. Perhaps a system that will only let you tell it which clock is the most accurate, and only if you prove you are the proper authority and only if 4 other clocks are on the same minute. o Redundant hardware and power collection and data transmit /receive systems, flash ROM hard drives for storing secret keys and neccesary programs and files. Built to last several centuries if possible. o Key pairs could be generated on Earth, a time of release instruction and perhaps an optional other public key a (return at future date encrypted with this key option.) The package is then encrypted with one of the lunar systems keys, then transmited to the Moon. A verification could be encypted and sent back to insure data integrity. o Other security checks in place would insure that the data was transmited to the Moon by the proper authority, i.e. the Corp. charging for this service. Additional backup logic that would insure that proper power and protocol exist for transmitions from the lunar system. o The key pairs are witness generated, then sent to the lunar system, then the secret key is destroyed on Earth. The public keys become a one way hash to the future until the time designated by the key's owner has elapsed. Then the lunar system would transmit the owners secret key to Earth. o Upon time released instructions the lunar system would transmit the secret key, (encrypted if optioned) upon demand by a known packet radio method. So if the Corp. authority did not exist in say, 100 years, the data could still be retrieved by standard packet radio. People who want to write to ONLY their great great grand- children or the future world in general would have a forum. Jay /"""""\ ~~ ,--------------------------------------------, ~~ /"""""\ /__ - _-\ ~~ ( End HEMP Prohibition! This is an open chal- ) ~~ /-_ - __\ :@ (*)~(*) ~ ( lenge to Historians. Name examples of where ) ~ (*)~(*) @: :%/--~ ))~: ~ (& when the cultivation of legal hemp was harm-) ~ :~(( ~--/%: \__"-==-===* ( ful or destructive to a society in any way! ) *===-==-"__/ (:"\_)_/ (<jay.hyden(a)alpha.c2.com> PublicKey on Servers) \_(_/":) .//:%:%:\. '---------------------------------------------' ./:%:%:\\. =000o====o000===================================================000o====o000= | | | | | | | | | | | - ----------------------------------------------------------------------------- | | | | | | | | | | | | - ----------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGiLha7iRhcfEZiZAQEn0QP6A8cUmI0MHs866Mu/Ao4mFqr89F8tT3oP KeafNdSWJt8/pOlVZzQxV8P8S8dCkXwBgJJQaQ6tigqtD2+9fK1HEaWi3ZBAVgB+ CwLhqouwds2A5+l9riQfqAT+4yrSbeNR+bH3xyYa8zZSTzp5DB1tJEbWls6Kjr/w hxmFYrf6oSk= =oHrR -----END PGP SIGNATURE-----

1 0

Is this just MY problem?
by bart＠netcom.com 17 Dec '03

17 Dec '03

Anon1 says: >... Whoever2 says: ... >... ... >... ... HUH? At this point I am no longer conversant with who is who, are you? So, what is the solution? Rather more explicit attribution I think.

1 0

RE: Is Mail being delayed?
by Bill Garland 17 Dec '03

17 Dec '03

>From Tim May : >C'punks, >Once again I'm seeing day-long delays in getting mail, and I don't >know if the problem is at the toad site or at Netcom's end (or at a >relay link in between). Hence this message. ... >If you are gettting mail out of order (replies from others before the >original appears) or delayed by more than several hours, drop me a >note if you would and I will summarize what I learn. This happens to me all the time. I quite often see duplicate postings, too, although the multiple-posting copies of the same message eg the Chaum ecash announcement was a different problem, possibly caused by the same delay problem - re-posters haven't yet seen the first copy. >I'm especially interested to hear from Netcom sites. Can't help you there, except provide evidence that it is not a local netcom problem. Not to say netcom doesn't have local problems... I am at the end of the world here, at least the corner of North America. Think of me as your East Coast Sentinel - I can see Signal Hill from here if I go outside, and I can see Cape Spear from there. On Signal Hill there actually is one of those posts with arrows pointing to New York, London, Moscow, etc, with all the mileage. (Maybe I should invent East Coast Sentinal as a pseudonym.) There are two lines into here for Internet traffic, and perhaps soon to be others, but except for that, we are the end of the line. Might make traffic analysis a problem someday. >--Tim May /----------------------------------------------------------------------\ | I am an Extropian. | Macronic Systems, Inc. offers Ideas for Sale ! | | BEST: DO_IT_SO ! | Go for it : Pledge a Digital US Dollar now. | | CryptoAnarchist. | Send PGP key for more information. | | Cypherpunk. | Get in on the ground floor. Invest Now. Trust me! | | Owner : MSInc., |---------------------------------------------------| | HEx, INFO_Banque | Day Job : Bill Garland = bill(a)kean.ucs.mun.ca | \__________________________________o o_________________________________/

1 0

Proof that tmp@netcom.com is Detweiler ?
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

Who/what is Detweiler ? > > From: Stanton McCandlish <mech(a)eff.org> > Message-ID: <net-community/orgs-list_769514754(a)rtfm.mit.edu> > Date: 21 May 1994 10:06:51 GMT > Expires: 25 Jun 1994 10:05:54 GMT > Reply-To: Stanton McCandlish <mech(a)eff.org> > Approved: news-answers-request(a)mit.edu > Supersedes: <net-community/orgs-list_767656298(a)rtfm.mit.edu> > NNTP-Posting-Host: bloom-picayune.mit.edu > X-Last-Updated: 1994/05/03 > Originator: faqserv(a)bloom-picayune.MIT.EDU > > Archive-name: net-community/orgs-list > Version: 3.13 > Last-modified: 94/04/08 > > > (This document has been brought to you in part by CRAM. See the > bottom for more information, including instructions on how to > obtain updates.) > > === [massive deletia] > === > CRAM: the Cyberspatial Reality Advancement Movement > > In an effort to bring valuable information to the masses, and > as a service to motivated information compilers, I > (L. Detweiler) will help others unfamiliar with Usenet > `publish' their documents for widespread dissemination via the > FAQ structure, and act as a `sponsor' knowledgable in the > submissions process. This document is being distributed under > this arrangement. > > I have found these compilations tend to appear on various > mailing lists and are valuable enough to deserve wider > distribution. If you know of an existing compilation of > Internet information that is not currently a FAQ, please > contact me and I may `sponsor' it. The benefits to the author > include: > > - use of the existing FAQ infrastructure for distribution: > - automated mail server service > - FTP archival > - automated posting > > - a far wider audience that can improve the quality, accuracy, > and coverage of the document enormously through email > feedback > > - potential professional inquiries for the use of your > document in other settings, such as newsletters, books, > etc. > > - with me as your sponsor, I will also take care of the > technicalities in the proper format of the posted version > and updating procedures, leaving you free of the `overhead' > to focus on the basic updates alone > > Send comments relating to the *distribution* of this document > (particularly relevant newsgroups not currently covered in > its current distribution) or inquiries on other documents to > <tmp(a)netcom.com>. > > The choice of who I `sponsor' is entirely arbitrary. You always > have the option of handling the submission process yourself. > See the FAQ submission guidlines FAQ in news.answers. > -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0