- cypherpunks-legacy - lists.cpunks.org

Re: INTERNET SECURITY RISKS FOR CONSUMERS OVERBLOWN
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> "If someone wanted to steal a credit card number, all they would > have to do is go to any gas station and look on the ground around > the pumps," says the CTO at Internet security firm Terisa Systems. Sure, if you wanted to steal a card number or two the ground around a gas-station would probably be a good choice. However, if you wanted to steal a thousand card numbers (or maybe even thirty thousand), just sniff packets off a hub near a large Web site that accepts unencrypted (or weakly encrypted) card transactions or hack your favorite ISP's machines. It really bothers me that officers at companies writing net commerce software are regularly quoted in the trade rags comparing the relatively little risk of a single net card transaction vs. a transaction at a restaraunt or gas station. We aren't talking about a crooked clerk who handles at most a few hundred cards per day or an unlocked dumpster with maybe the same number of carbons in it. We are talking about potentially hundreds of thousands of card numbers whizzing through a single point that could be easily (and undetectably) monitored and recorded with off-the-shelf-equipment for later analysis. Even if the transactions are encrypted, a single exploitable weakness discovered after widespread deployment could compromise massive numbers of cards. The stakes are much higher and this will invite much more sophisticated crooks to attempt to defraud the system. andrew

2 1

Commercial Apachessl
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

Hi Sameer. You mentioned the server won't be commercially free for licensing reasons? (erased that post, darn) The RSA ones? Would it be free for commercial purposes in Canada? (Are the problems restricted to RSA or also RC4?)

1 0

Re: Questions/Comments on ecash protocol (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Hal wrote: [parts elided] >BTW since apparently both deposit and payment messages are not encrypted, >coins made out to "@" are in danger of being stolen both while en route >from customer to shop and from shop to bank. This is significant from >the point of view of payee anonymous systems, which will need to use such >coins. More encryption will be necessary when such coins are passed >around. Absolutely. Wildcard coins are stealable in transit. However, one might safely assume that transactions conducted using such coins be encrypted by other methods. >Well, I would think identification of the payer's bank will be >necessary for any coin based system so you know where to cash in the >coins, so I don't think this is going to go away. Of course as of now >everyone has the same bank so it is not an issue. Your analysis is correct. The good news, for the free marketers on this list :-), is that there will be other banks issuing Ecash in the near future. However, they are unlikely to offer the flexibility you have with Mark Twain Bank. >There is no such thing! This is one of the most common misconceptions. >This version of ecash does not trace double spenders. It prevents double >spending by checking each coin to make sure it has not already been >spent. Tracing of double spending is only necessary in offline systems >where coins are not checked right away, but that is not present here. True. >Very good comments. I'm sure the next version will be much better if >they are careful to clear up the kinds of issues you have raised. Will do. <insert standard disclaimer here> -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Privy Affairs
by John Young 17 Dec '03

17 Dec '03

The WSJ and Financial Times report today on The New Transatlantic Agenda, the trade and security pact signed by the US and Europe yesterday to "boost cooperation." [WSJ] The accord's center piece commits the parties to working together on 150 specific policy areas, including cutting trade barriers, strengthening cooperation in nuclear nonprofliferation and fighting international crime. "There are mixed urges in Europe right now," says Kirsty Hughes, head of the European program at the Royal Institute for International Affairs in London. "On one hand, the nations of Europe want to keep the U.S. involved in European affairs, and on the other, they want to develop their own economic, political and security arrangements." Then, the Fin Times piece, headlined "Clinton and EU leaders agree on crime," reports on a variety of issues but mentions only in passing the phrase "crime, drugs and terrorism." This treatment suggests that there is more boosting of security and crime-fighting cooperation than the press is reporting -- or privy to. Recall recent reports on: A World Trade Organization cyberspace czar to bring law and order to the unruly Net. EU plans for setting standards and certifications for products, including software for computer security, encryption and authentication. The future threat to "the West" by a hyper-cyber Asia [ex-colonies] deploying information wizardry to level the playing field. Cooperation on trade and "crime, drugs and terrorism" might then be a euphemism for economic aggression -- US-EU international affairs arranged to maximize benefits for transatlantic self-interests. If so, then cryptography is truly a highly valuable munitions for economic warfare, worthy of the strongest law and enforcement measures, closely fit to the power of the weapon. With US-EU GAK and ITAR to protect markets of the transatlantic super-nation and selected meta-atlantic partners in crime-pure joy. Would Michael Froomkin, RIIA Foreign Associate, care to generously unscramble this international affairs sigint? Air the pinstriped privy, ahem.

1 0

Re: Do the Right Thing
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Mon, 4 Dec 1995 01:42:25 -0800 > To: cypherpunks(a)toad.com > From: anonymous-remailer(a)shell.portal.com > Subject: Re: Do the Right Thing > On Sun, 3 Dec 1995, Timothy C. May wrote: > > > > Netscape, being the dominant browser company, and Microsoft, being the > > dominant OS company, are in special positions to "build in Big Brother." > > I'm not claiming they are, just that they are clearly in a position to make > > it technologically more feasible to make non-GAK illegal. They both need to > > carefully think about the role that's been "given" to them (whether by > > fortune, hard work, or being in the right place at the right time) and do > > what's right. > > That's always a tough position to be in. If Netscape or Microsoft > knew what was the "right" thing to do, I don't doubt that they'd be > doing it. That's one of the most politically and socially naive statements I've ever heard. Corporations *never* do the "right thing" unless it will increase their profits. Remember, corporations are in business to make money by providing a product or service that people will pay money for. Whatever gets in the way of that will fall by the wayside. That's an economic fact of life.

1 0

Crypto stuff
by Bob Johnson 17 Dec '03

17 Dec '03

Could you send me some info on crypto stuff. I need to secure some files and as yet havent figured out how to do it. If you can help I would appreciate it.

1 0

Re: Do the Right Thing
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 4 Dec 1995, Ed Carp wrote: > > > Netscape, being the dominant browser company, and Microsoft, > > > being the dominant OS company, are in special positions to > > > "build in Big Brother." I'm not claiming they are, just that > > > they are clearly in a position to make it technologically more > > > feasible to make non-GAK illegal. They both need to carefully > > > think about the role that's been "given" to them (whether by > > > fortune, hard work, or being in the right place at the right > > > time) and do what's right. > > > > That's always a tough position to be in. If Netscape or Microsoft > > knew what was the "right" thing to do, I don't doubt that they'd be > > doing it. > > That's one of the most politically and socially naive statements I've > ever heard. Corporations *never* do the "right thing" unless it will > increase their profits. Sure, I realize this. I'm very aware of it in fact. The art of persuasion is the science of selfish self-interest. Once a company realizes that their "profits" are in jeopardy, or that individual corporate officers are liable to face prison time, then they generally do the "right" thing, what's in their interest. It's just like asking questions. You never ask a question to which you don't already have the answer. > Remember, corporations are in business to > make money by providing a product or service that people will pay > money for. Whatever gets in the way of that will fall by the > wayside. That's an economic fact of life. Sure. This is true. Facts of Life. Stiff upper-lip and such. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

another fbi prosecution
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Chronicle of Higher Education (Dec 8, 1995) page A21 reports that Monmouth University (West Long Branch, New Jersey; http://www.monmouth.edu) sophomore Dominick LaScala was charged last week in federal court with two counts of computer fraud. Dominick had his campus account taken away after other users complained that he had been "advertising business proposals inappropriately on line." The FBI alleges that he then sent 24,000 email messages in one day from a commercial account (unamed) to Monmouth's system.. This denial of service attack was successful for about 5 hours. He is facing six(6) years in prison and a up to $350,000 in fines (1.20 years/hr and and $70,000/hr). His lawyer (Kenneth Weiner) claims that "even if his client sent the mail bomb" since no damage was done to the system, he could not be convicted under the computer fraud statute. He also claims that prosecutors are trying to make an example of his client. The university is still trying to figure out whether he can be punished under the university code of conduct.

1 0

Re: Netscape gives in to key escrow
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

SMTP%"unicorn(a)schloss.li" 4-DEC-1995 23:35:15.06 writes >On Mon, 4 Dec 1995 JR(a)ns.cnb.uam.es wrote: > >> Black Unicorn <unicorn(a)polaris.mindport.net> wrote >> >On Fri, 1 Dec 1995 JR(a)ns.cnb.uam.es wrote: ... many cuts all along to save bandwidth ... > >I'm afraid you have missed the point too. > >I don't care as much what the personal positions are, or what the ethical >center from which person x or person y works. > >I am most distressed because of what I see as a snowjob. > >"We are anti-GAK" > >Great, tell me what you have done to prevent GAK from proliferating. > >In the absence of an answer to that challenge, I have to question the >first statement as fluff or PR. > >This has nothing to do with Netscape sharing my opinion, or not sharing >my view on the evil of GAK. It has to do with putting up or shutting >up. I have been told that Netscape agrees with me, or will agree with >me, I just don't know that I believe it yet. For the last time: I have nothing to do with Netscape. So, please, stop making silly associations. What I do to defend my opinions it to try and get more people involved in the subject, explain the problems in terms they can understand, discuss with them about possible solutions (sometimes they have better ideas than me) and try to promote an effective course of action. And in any case that's *my* business. Being in a different country and even continent, what I do may not be of any direct consequence to you. And since I have nothing to do with any commercial company -hey I don't even use Netscape- it has no relationship whatsoever with Netscape or any other company. If you think that people likes to hear complains, go along. In my experience people is more cooperative when they see better solutions than just making a boicott and renouncing to use things they like. So, I'll keep on explaining what crypto can do for them and how easy it is to be taken advantage of. And how easy it is for them to press and get what they deserve. WRT legal courses of actions, just remember there's a whole world our your privy. It's sad you don't know better, but if you look around carefully you'll discover that many of the proposed actions are not feasible in many places. Just go out of your shell. I haven't either. I wouldn't be here if I did. jr

1 0

gondolin.org remailer announcement
by Gondolin Mixmaster Remailer 17 Dec '03

17 Dec '03

Gondolin Technologies is proud to announce our resumption of remailer services to the online community. Some of you may remember the remailer services based at <mixmaster(a)gondolin.org> that was on-line for most of this year. We are now back and better than ever with highly improved hardware and net connections. We are hosting a Type I "Cypherpunks" remailer, as well as a Type II "Mixmaster" remailer at <mix(a)remail.gondolin.org>. The PGP public key for the type I remailer is below: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzC7/HwAAAEEAKFLOSwJ6FdRb/Z0Yj+RV3inx9aRtrJI+5kXpZTWtcQNo50K qKzRB9joL68jxeQTa4FTOFsWlbsn7dCcOpkOCJqoo4Uby+bIDRP8E5MYGgALVoNh xO6Hucj2Hh1v+koOTvtv4lDWaDdhxN7rPPb8KlTC2FPFIK9/2n7xTkxYcqfxAAUR tDJHb25kb2xpbiBUeXBlIEkgUmVtYWlsZXIgPG1peEByZW1haWwuZ29uZG9saW4u b3JnPokAlQMFEDC+kr2Oh92U+GrHWQEB3s8EAI6+3t59tYB+EWUQDWvSaPNqihab 8lRkctA0gPtOWD3f6nOBcPjIrAoeZ3mB5ASJwPkXGbe6rTGrBo6HuC2t45bscviV O46wKKX6aIJnsCM6vx/vm1aWdm/a5DsBv1BYnnNEedrwFlvzzAhBFtolK1a7i6+N PDnfGlrs9q6U+9LBiQCVAwUQMLv8rPvQGgQ7UJMZAQECYgP9E2riZwFPvNFpKuX9 9JbG4PJGzOm7TAQO1/hIb9BAk7KrLs7yQuTzfQs6hAXB88o1ofIPYp5uz/GvAleg wCGIA3ZnhYh5yiS4UArZbCfr8hDvXsUqQBxR5tfLHj5qOkOejFckIHCRC/8wb23g 3Xu7Zh00PpJAD1EZVfDdhseMXGE= =AJYL -----END PGP PUBLIC KEY BLOCK----- The Type II remailer supports posting via mail2news gateways. We are using Mixmaster 2.0.3 from Lance Cottrell. The Type I remailer supports PGP encryption, latent time, hash marks, cutmarks, and so on. Our type I software is John Fleming's Freedom Remailer v1.6beta. Our remailers also utilize a reordering pool. Address any comments, complaints, or concerns to <remailer-admin(a)gondolin.org>. - Bryan Strawser, System/Network Administrator, Gondolin Technologies

1 0