CDR: Re: Lions and Tigers and Backdoors, oh, my...
The words of Steve Furlong: -- begin quote -- I've been trying to find evidence of this, too. I've sent messages to self from several versions of Netscape Messenger on Windows and FreeBSD, then examined the headers. -- end quote -- You're looking in the wrong place. The "help fields" would be somewhere in the SSL tunnel setup. That's where the Wells Fargo case came to light. Suddenly one day, the banking site required me to "upgrade" my browser, allegedly because of an expired certificate. As others have mentioned, simply upgrading the cert itself didn't satisfy the site. So ostensibly, the NSA, et al, have a bit of assistance in cracking the 128-bit SSL session. You may recall a few years ago when the information lifetime of 40-bit SSL fell somewhere below 3 hours, given access to enough parallel CPU (like a college workstation farm). Moore's Law hasn't slowed down. I'd be surprised if 40-bit could stand much more than an hour of dedicated attack today, if even that. And these rumored "help fields" could easily reduce the keyspace far below 40 bits, if they don't simply expose the whole key to a knowledgable eavesdropper. "They" don't care much about your email... "they" want your bank balance and credit card numbers.
The words of Steve Furlong: -- begin quote -- I've been trying to find evidence of this, too. I've sent messages to self from several versions of Netscape Messenger on Windows and FreeBSD, then examined the headers. -- end quote --
You're looking in the wrong place. The "help fields" would be somewhere in the SSL tunnel setup. That's where the Wells Fargo case came to light. Suddenly one day, the banking site required me to "upgrade" my browser, allegedly because of an expired certificate. As others have mentioned, simply upgrading the cert itself didn't satisfy the site.
So ostensibly, the NSA, et al, have a bit of assistance in cracking the 128-bit SSL session. You may recall a few years ago when the information lifetime of 40-bit SSL fell somewhere below 3 hours, given access to enough parallel CPU (like a college workstation farm). Moore's Law hasn't slowed down. I'd be surprised if 40-bit could stand much more than an hour of dedicated attack today, if even that. And these rumored "help fields" could easily reduce
Capturing and analyzing the traffic between the browser session and the bank would be a good place to start. I believe there is a tool for Windoze that will let you packet sniff (even a PPP) connection. <Conspiracy theory mode=OFF> My employer blocks certain versions of browser's from going through our firewall because of reported security vulnerabilities. Yeah, I know it's easy to spoof, but it insures that our "less sophisticated" users upgrade. The bank may have been concerned about a security problem in the version of the browser you were using. <Conspiracy theory mode=ON> Then again, they could of just said that, I guess (unless they were doing the "security through obscurity" bit). You could try getting the source for Mozzilla, verifying it, compiling it, and then trying to access your bank. Neil M. Johnson njohnson@interl.net http://www.interl.net/~njohnson PGP Key Finger Print: 93C0 793F B66E A0C7 CEEA 3E92 6B99 2DCC ----- Original Message ----- From: <brflgnk@cotse.com> To: <cypherpunks@einstein.ssz.com> Sent: Wednesday, September 27, 2000 9:31 PM Subject: CDR: Re: Lions and Tigers and Backdoors, oh, my... the
keyspace far below 40 bits, if they don't simply expose the whole key to a knowledgable eavesdropper.
"They" don't care much about your email... "they" want your bank balance and credit card numbers.
Neil Johnson <njohnson@interl.net> wrote:
I believe there is a tool for Windoze that will let you packet sniff (even a PPP) connection.
Search for 'etherpeek' in google. Otherwise, use tcpdump or some such program in *IX. -- Riad Wahby rsw@mit.edu MIT VI-2/A 2002 5105
participants (3)
-
brflgnk＠cotse.com -
Neil Johnson -
Riad S. Wahby