- cypherpunks-legacy - lists.cpunks.org

Major security flaw in Cybercash 2.1.2 (fwd)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Bob Antia <antia(a)leftbank.com> Subject: Major security flaw in Cybercash 2.1.2 (fwd) To: mjbauer(a)leftbank.com (Michael Bauer), rah(a)shipwright.com Date: Sat, 8 Nov 1997 10:04:14 -0500 (EST) MIME-Version: 1.0 Approved-By: aleph1(a)UNDERGROUND.ORG Message-ID: <f58bccfc52aba91d0973f9bf33160ddd(a)anon.efga.org> Date: Fri, 7 Nov 1997 22:54:16 -0500 Reply-To: Anonymous <anon(a)ANON.EFGA.ORG> Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> Comments: This message was remailed by a FREE automated remailing service. For additional information on this service, send a message with the subject "remailer-help" to remailer(a)anon.efga.org. The body of the message will be discarded. To report abuse, contact the operator at admin(a)anon.efga.org. Headers below this point were inserted by the original sender. From: Anonymous <anon(a)ANON.EFGA.ORG> Subject: Major security flaw in Cybercash 2.1.2 To: BUGTRAQ(a)NETSPACE.ORG CyberCash v. 2.1.2 has a major security flaw that causes all credit card information processed by the server to be logged in a file with world-readable permissions. This security flaw exists in the default CyberCash installation and configuration. The flaw is a result of not being able to turn off debugging. Setting the "DEBUG" flag to "0" in the configuration files simply has no effect on the operation of the server. In CyberCash's server, when the "DEBUG" flag is on, the contents of all credit card transactions are written to a log file (named "Debug.log" by default). The easiest workaround I've found is to simply delete the existing Debug.log file. In my experience with the Solaris release, the CyberCash software does not create this file at start time when the DEBUG flag is set to 0. The inability to turn off debugging is noted on CyberCash's web site under "Known Limitations". The fact that credit card numbers are stored in the clear, in a world readable file, is not. --jet -b Bob Antia antia(a)leftbank.com The Left Bank Operation, Inc. http://www.leftbank.com TCP/IP Internetworking LAN/WAN/NT/UNIX Admin PGP fingerprint 9B 70 FF 2D 03 CC 5F C1 3E 29 6E D4 16 79 44 A8 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Bay Area Cypherpunks meeting announcement
by Colin Plumb 17 Dec '03

17 Dec '03

Additionally, there will be a release of the PGP 5.0 Unix Specific Source Code Update at the public meeting. -- -Colin

1 0

DO YOU WAGER / GAMBLE ON SPORTS ?
by 99001680＠msn.com 17 Dec '03

17 Dec '03

MR ACTION HAS THE WINNERS FOR SUNDAY & MONDAY NFL & BASKETBALL GUARANTEED TO WIN !!! UP NOW AT 1-900-484-7777 $18.00 per call Under 18 years of age ?? Don't Call!!! This is a guaranteed pick line. If you do not have a winning day with these selections we will replace the selections or make a refund!!

1 0

Content controls
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:29:04 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Content controls Cc: whgiii(a)invweb.net, dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) >>>A whole bunch of people are now talking about these cash-settled recursive >>>auction processes, and they're a direct, and now obvious, consequence of >>>bearer (or at least instant) settlement markets for information on geodesic >>>networks. When you add anonymity to the transaction, you pretty much have >>>the final straw for "rights" tracking. Watermarks just tell you who the >>>information was stolen from, for instance. So, one more industrial >>>information process bites the dust. > >>Whoa! Hang on here. Sure, watermarks will tell you who information was >>stolen from, but they're just a stalking horse... a weak second cousin to >>*persistent* content control technologies (such as IBM's Cryptolopes and >>Intertrust's Digiboxes). These allow rightsholders to manage a wide >>range of parameters (including price, usage context, and any other >>variable for which you can imagine having a certificate). Whats >>fundamentally different about what are generically referred to as secure >>envelopes, is that they can maintain controls *indefinitely* >>(persistence), across an un- >>known, ad hoc, web of distribution over which one otherwise has no >>control. And yes, this can all work even in a completely disconnected >>environment (laptop at 35,000 feet). > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new >>ways, based on entirely new (or old) business models, that take advantage >>of rich/elaborate conditions for usage (e.g. you can view this picture >>anonymously, but it will cost you 2X as much, and you can only get it at >>low resolution, and you can't view it at all unless you can prove that >>you don't live in the Middle East). No certificate for these conditions? >>Sorry, no content. > >>They are based the same basic stuff (public key cryptography of course) >>that *can* fuel wild anarchic visions of anonymous exchange. ;) > >>But they aren't at all deterministic of any particular economic model. > >Well how exactly does one prevent data from being stolen once it has been >unlocked? I pay my 2X to view the picture anonymously and now I copy it >save it and distribute it worldwide. I fail to see how any >encryption/watermark scheme can prevent me from doing so. The control technologies to which I referred earlier turn the lock/unlock idea into far more than a binary choice. This is what I meant by "persistence". The content cannot be used without its accompanying control set (which again, *might* include payment). Part of the control set I may impose on anonymous viewers could include preventing them from copying or saving the content directly in digital form. This is counter-intuitive to those of us who are used to having cut/paste available at our fingertips in most applications, but its relatively trivial to disable these functions on a file by file basis. Alternatively, I might impose controls that permit anonymous users to see *only* lower reso- lution versions. (by analogy, if you're going to wear a ski mask into a jewelry store, you aren't likely to be shown the expensive stuff - if they let you in the door in the first place). If you were really determined, you could always take a photo of the screen, re-scan it, do some image enhancement to get rid of the graini- ness, re-save it and post it on your web page for all to see, (the so-called digital-to-analog-to-digital work-around), but this is darned inconvenient. Also, try doing that with music or movies.... while avoiding the roving automated net 'bots that will be out looking for illegal copies of content (these are already common). Not worth it. For most people. If it were, we'd already have massive illegal scanning operations in third-world countries, and plenty of demand for their wares. Sure, this exists, and may even grow a bit around the fringes, but this hardly proves the case for a single vision of an anarchic Robin Hood future for all content (Sell today else I rip you off tomorrow!!) As a non-disclosed third party, I'm not at liberty to discuss the 'guts' of either the Crytolope or Digibox technologies (though I have seen them) Both are covered, as you might imagine, by a fairly extensive array of active and pending patents. If you want to learn more, I'd recommend contacting them directly: www.intertrust.com (or their partner, Softbank NetSolutions) www.infomkt.ibm.com Cheers. - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Hughes Markets? (finally some stimulating debate on dcsb)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:28:21 -0500 To: "R. Jason Cronk" <listmanager(a)orange.redmans.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Re: Hughes Markets? (finally some stimulating debate on dcsb) Cc: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) I wrote: >>Whoa! Hang on here. Sure, watermarks will tell you who information >>was stolen from, but they're just a stalking horse... a weak second cousin >>to *persistent* content control technologies (such as IBM's Cryptolopes >>and Intertrust's Digiboxes). These allow rightsholders to manage a wide > ><SNIP> > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new To which R. Jason Cronk replied: >"if they so choose" and here is where I submit the two camps divide. Yep. I couldn't agree more. There will be at *least* two, (and probably more like 2000) 'camps'. And here is where I think we diverge.... >Sure, you can decide to try to hold on to the rights, but it is going to be >market suicide. Your best bet is to sell it all off, get what you can for >it and do it again. In other words, a recursive auction market. With more sophisticated tools for rights management, the market contest can move to another level, with content business models *themselves* vying for attention. Recursive auctions are merely one of these models. They may make perfect sense for the kind of content that is going to decline in value over time anyway (news, for example). Not all content works this way though. Recursive auction markets are exciting because for the most part, they haven't been possible in 'copyright' industries until recently. Its easy to say that they will be more important than they are today. They will. But to say that they are fore-ordained as the only way for creators to get compensated is much too narrow. This view would only make sense if detaching copies from usage controls were easy. Today it is, and there is a common misconception that this will continue. But it won't. Cryptographers especially should understand this. The same base technology that makes it extremely difficult to mint one's own digital coins in someone else's currency will make it extremely difficult to use someone else's digital content without complying with their controls (including payment). It is inconsistent to say that digital money can have persistent value and digital content cannot. Both are information. Both based on a common faith in a 'brand': either the U.S. Treasury or Disney. Same idea. Best, - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

E-Peso's for tractors - McCaffrey on banking
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Blair Anderson" <blair(a)technologist.com> To: "dcsb(a)ai.mit.edu" <dcsb(a)ai.mit.edu> Date: Sun, 09 Nov 97 01:53:59 +1300 Priority: Normal MIME-Version: 1.0 Subject: E-Peso's for tractors - McCaffrey on banking Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Blair Anderson" <blair(a)technologist.com> 06:24 p.m Nov 05, 1997 Eastern U.S. drug czar appeals to banks to track laundering By Anthony Boadle WASHINGTON (Reuters) - Bankers, watch those ``smurf'' accounts. That was the message drug enforcement authorities gave the American Bankers Association and the American Bar Association at their annual money laundering conference Wednesday. Any innocent-looking person could be depositing a drug baron's cash parceled into amounts smaller that the $10,000 reporting threshhold to avoid suspicion, so get to know your customer, they warned. Traffickers hire individuals or ``smurfs'' who open small accounts at U.S. banks in their own or fictitious names. Once in the system, drug money becomes very hard to trace, White House drug policy director Gen. Barry McCaffrey said. Americans spend $49 billion a year on illegal drugs and much of that cash has to go through banks and corporations to get back to the Colombian cartels that ship cocaine and heroin to the the United States, he said. McCaffrey said drug traffickers were becoming increasingly sophisticated in laundering their proceeds, resorting to high tech communication encryption and ``cybercash'' transactions over the Internet. ``We are not going to find dumb guys stumbling into bank branches in New York City with cardboard boxes full of $20 bills that test positive for cocaine,'' he said. ``We are losing contact with the enemy,'' the general said. ''The government cannot follow laundering by itself. You are going to have to help.'' McCaffrey said the drug trade was moving into new areas such as the securities industry to launder its profits. Treasury Department Undersecretary for Enforcement, Raymond Kelly, said Colombian cartels were using a black market peso brokering system to send home their profits. Cartels sell their dollars at a discount to Colombian businessmen who need to buy goods in the United States. The dollars go to pay the U.S. manufacturer or exporter. The pesos never leave Colombia and end up in the drug baron's account. A hooded Colombian woman testified in Congress last month that she had laundered money through large U.S. banks and corporations unwittingly used by black market peso brokers. She cited the case of drug dollars going to pay for a tractor for a Colombian farmer. Keely, a former New York City police commissioner, warned that money laudering was corroding financial institutions. ``It is the source and the product of a burgeoning global parallel trading system that serves the emerging criminal holding companies,'' he told the bankers and lawyers. Kelly said the Clinton administration has worked to lessen the burden of the Suspicious Activity Reports that banks are obliged to file under the Banking Secrecy Act. The banking industry complained it had to file 12 million such reports in 1996, a time consuming and costly activity. New regulations exempts banks from reporting on certain customers, such as corporations listed on stock markets and their subsidiaries. But a new set of rules exempting additional businesses has caused an uproar among bankers because they would have to track the daily currency operations of these businesses for one year and project their annual currency needs. Copyright 1997 Reuters Limited. All rights reserved. Blair Anderson (Blair(a)technologist.com) International Consultant in Electronic Commerce, Encryption and Electronic Rights Management "Techno Junk and Grey Matter" (HTTP://WWW.NOW.CO.NZ [moving servers, currently inactive]) 50 Wainoni Road, Christchurch, New Zealand phone 64 3 3894065 fax 64 3 3894065 Member Digital Commerce Society of Boston ---------------------------- Caught in the Net for 25 years ---------------------------- For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Re: Content controls
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <v02140b10b08a1ba0a4ac(a)[198.115.135.201]>, on 11/08/97 at 09:29 AM, hutchinson(a)ncri.com (Art Hutchinson) said: >>>>A whole bunch of people are now talking about these cash-settled recursive >>>>auction processes, and they're a direct, and now obvious, consequence of >>>>bearer (or at least instant) settlement markets for information on geodesic >>>>networks. When you add anonymity to the transaction, you pretty much have >>>>the final straw for "rights" tracking. Watermarks just tell you who the >>>>information was stolen from, for instance. So, one more industrial >>>>information process bites the dust. >> >>>Whoa! Hang on here. Sure, watermarks will tell you who information was >>>stolen from, but they're just a stalking horse... a weak second cousin to >>>*persistent* content control technologies (such as IBM's Cryptolopes and >>>Intertrust's Digiboxes). These allow rightsholders to manage a wide >>>range of parameters (including price, usage context, and any other >>>variable for which you can imagine having a certificate). Whats >>>fundamentally different about what are generically referred to as secure >>>envelopes, is that they can maintain controls *indefinitely* >>>(persistence), across an un- >>>known, ad hoc, web of distribution over which one otherwise has no >>>control. And yes, this can all work even in a completely disconnected >>>environment (laptop at 35,000 feet). >> >>>They allow rightsholders, if they so choose, to *continue* being rights- >>>holders in a highly networked, digital world, and in a wide range of new >>>ways, based on entirely new (or old) business models, that take advantage >>>of rich/elaborate conditions for usage (e.g. you can view this picture >>>anonymously, but it will cost you 2X as much, and you can only get it at >>>low resolution, and you can't view it at all unless you can prove that >>>you don't live in the Middle East). No certificate for these conditions? >>>Sorry, no content. >> >>>They are based the same basic stuff (public key cryptography of course) >>>that *can* fuel wild anarchic visions of anonymous exchange. ;) >> >>>But they aren't at all deterministic of any particular economic model. >> >>Well how exactly does one prevent data from being stolen once it has been >>unlocked? I pay my 2X to view the picture anonymously and now I copy it >>save it and distribute it worldwide. I fail to see how any >>encryption/watermark scheme can prevent me from doing so. >The control technologies to which I referred earlier turn the lock/unlock >idea into far more than a binary choice. This is what I meant by >"persistence". The content cannot be used without its accompanying >control set (which again, *might* include payment). Part of the control >set I may impose on anonymous viewers could include preventing them from >copying or saving the content directly in digital form. >This is counter-intuitive to those of us who are used to having cut/paste > available at our fingertips in most applications, but its relatively >trivial to disable these functions on a file by file basis. >Alternatively, I might impose controls that permit anonymous users to see >*only* lower reso- >lution versions. (by analogy, if you're going to wear a ski mask into a >jewelry store, you aren't likely to be shown the expensive stuff - if >they let you in the door in the first place). Can't do it. :) Once you have given me the keys to unlock and display the data I can save it, copy it, reproduce it and distribut it. To assume otherwise shows a lack of understanding of computer systems and moderen OS's. Sure I would need to write some software and jump through some hoops to do it but there is nothing that your system can do to prevent me from doing so. Now wether it is worth the effort to do so will depend on the value of the data involved. Once you have given me the ability to display the data you have lost the battle as I can do whatever I want with it. As far as the anonymous purchaces, no a big deal. Wan Sin Soo pays the full $$$ amount decrypts the data, copies it and send it too his buddies in Bangledesh. Next week there is a million copies of your data floating around the Far-East and Wan Sin Soo is nowhere to be found. The fact that he bought it non-anonymously is of little relevance. >If you were really determined, you could always take a photo of the >screen, re-scan it, do some image enhancement to get rid of the graini- >ness, re-save it and post it on your web page for all to see, (the >so-called digital-to-analog-to-digital work-around), but this is darned >inconvenient. Also, try doing that with music or movies.... while >avoiding the roving automated net 'bots that will be out looking for >illegal copies of content (these are already common). Not worth it. >For most people. digital-analog-digital is completly unnessasary. >If it were, we'd already have massive illegal scanning operations in >third-world countries, and plenty of demand for their wares. Sure, this >exists, and may even grow a bit around the fringes, but this hardly >proves the case for a single vision of an anarchic Robin Hood future for >all content (Sell today else I rip you off tomorrow!!) There are. China, Russia, Eastern Europe, Far East. You have multi-million dollar operations that all they do is pirate software, movies, music, ...ect. If the can make money pirating your data then the will do so. >As a non-disclosed third party, I'm not at liberty to discuss the 'guts' >of either the Crytolope or Digibox technologies (though I have seen >them) Both are covered, as you might imagine, by a fairly extensive array >of active and pending patents. If you want to learn more, I'd recommend > contacting them directly: I have not looked at Digibox but I have looked at Crytolope and the technology can be defeated. All these systems do is make it hard for Joe SixPack running WinBlows 2000 to make a couple of copies for his freinds. For anyone determined to pirate the data this is just a minor inconvienance just like other such schemes in the past. - -- - --------------------------------------------------------------- William H. Geiger III http://users.invweb.net/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNGSJEY9Co1n+aLhhAQFOtQP/WlOYl/33Qeko3eFaBAWR6ajYcFoONYQ/ +vDLDgY55x3fVwoVumB62AjtUIXM+deHAruKjDw0rgLhzRhqilOndw/0D+FT8HV3 4W0rehoSG3s3T2hqkJq1vq29X+fQJ7LqE7nWTS0wWEZjBEMkPZyIv50/rRTSK+rB /VIF1esIG3o= =/qfm -----END PGP SIGNATURE-----

1 0

F00FC7C8 Kills P5
by Eric Cordian 17 Dec '03

17 Dec '03

In comp.sys.intel, the keeper of the Intel Secrets Website, rcollins(a)slip.net (Robert Collins) writes this absolutely amazing paragraph: > If nobody knew about this problem, nobody would be affected > by it. Therefore, without knowledge of this problem, there > really isn't a reasonable security risk to multi-user > systems. > No, I had no desire to publicize the bug. Egads. Talk about "Security by Obscurity"! Someone buy this poor man a Cypherpunks subscription. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Mathematician Sidney Darlington Dies
by John Young 17 Dec '03

17 Dec '03

NYT obit November 8: Sidney Darlington, a Bell Labs mathematician who pioneered the design of electronic circuits and whose formulas helped launch rockets 300 times without error, died on Oct. 31 at his home in Exeter, N.H. He was 91. At Bell Labs, in Murray Hill, N.J., where he headed the mathematics research center, Dr. Darlington was ranked alongside his colleague Claude Shannon for breakthroughs in communications networks that foreshadowed the integrated circuit and in turn computers and modern communications. Dr. Darlington's discovery of ways to custom-design circuits using precise mathematical specifications, a speciality now called network synthesis theory, made him a leading authority in electronic cirsuits for decades, said Dr. Ernest Kuh, a former colleague who is now at the University of California at Berkeley. Before Dr. Darlington's work, circuits were designed in an intuitive, ad hoc manner. His advances won him the highest award in his field, the Medal of Honor of the Institute of Electrical and Electronic Engineers. At a chalkborad at Bell labs with three or four other rocket guidance experts, he would scrawl equations that became the basis for guiding the Air Force Titan I, the Thor-Delta and dozens of other rockets. His rocket guidance formulas could instantly plug in the information from several sources -- the trajectory designed to launch a staellite, the data from radar that tracked the rocket, and the instruments in the rocket itself -- and could then return a flow of commands to the rocket. Always a tinkerer, Dr. Darlington in the 1950's spent a weekend at home playing with a new gadget, the transistor. Trying to get more gain from an amplifier the size of a kernel of corn, he found a way to combine two or more transistors in one chip, an idea that became the Darlington Compound Chip and pointed the way toward integrated circuits. ----- For more see NYT online: http://www.nytimes.com

1 0

Mixed Messages / Re: F00FC7C8 Kills P5 AND Re: Major security flaw in Cybercash 2.1.2 (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Eric Cordian wrote: > In comp.sys.intel, the keeper of the Intel Secrets Website, > rcollins(a)slip.net (Robert Collins) writes this absolutely amazing > paragraph: > > If nobody knew about this problem, nobody would be affected > > by it. > > No, I had no desire to publicize the bug. > Egads. Talk about "Security by Obscurity"! Robert Hettinga wrote: > Subject: Major security flaw in Cybercash 2.1.2 (fwd) > CyberCash v. 2.1.2 has a major security flaw that causes all credit > card information processed by the server to be logged in a file with > world-readable permissions. This security flaw exists in the default > CyberCash installation and configuration. We at the Electronic Fraud Foundation also have no desire for these bugs to be publicized. We're making a goddamn fortune off of them. (Damn near as much as we're making off of our remailer-donation scam.) Ura Fishpal, Flounder, Electronic Fraud Foundation [Note: You are required by Federal Law to pay me one dollar for reading this post. Send $1 to EFF, Box 281, Bienfait, Sask. Canada S0C 0M0] [Note From Your System Administrator: Failure to comply with the above will result in loss of your access privileges and a hernia.]

2 1