RE: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
no doubt all the responses to the cypherpunk list are unnecessary as we all agree this is a load of PR nonsense. But I just can't believe that he thinks that the telephone is more secure on average than a keyboard. I can tell pretty easily if something is running on my system that I didn't intend..it is much less probably to say that I know that someone isn't listening with a scanner if I'm on a cordless or just plain tapping my line if I'm on a standard phone. Admittedly I think cell phones may take more effort on the part of the eavesdropper but are still doable. I'm certain that none of first virtual customers use a cordless phone, indeed since you feel the telephone is such a secure device you no doubt require that all of your customers use STUIII phones to communicate. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 12:07 PM To: cypherpunks@toad.com Subject: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards First Virtual's Internet Payment Systems never places the consumer's credit card number on the Internet. Instead, the consumer provides it to us by telephone when the account is opened. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 1:39 PM To: cypherpunks@toad.com; dmacfarlane@zip.sbi.com Subject: Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!) Well, the mis-conceptions are flying fast and furious. You're twisting our words. We believe it is a truly fatal flaw in those internet commerce schemes that are based on software encryption of credit card numbers. There are several schemes for Internet commerce that are unaffected: -- First Virtual (of course)
Nathaniel Borenstein wrote:
We have a few pages of C code that scan everything you type on a keyboard, and selects only the credit card numbers. How easy is that to do with credit card numbers spoken over a telephone?
The key is large-scale automated attacks, not one-time interceptions.
This fact that the filtering can be done on the client side is nearly irrelevant. Most people do not hit enough keystrokes in a day to prevent sending the entire keyboard stream back to the filtering agent. Since most folks do not spend most of their time typing in nonsense phrase, you could probably pick out the First Virtual account number also. With only a little more cleverness you can get the file containing private keys. With a few thousand tries through the stream you can decrypt that file using the user's pass phrase. If you have the ability to change the software on the user's machine to something arbitrary, why bother stopping at something as "trivial" as a single credit card number. PK -- Philip L. Karlton karlton@netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation
But I just can't believe that he thinks that
the telephone is more secure on average than a keyboard. We have a few pages of C code that scan everything you type on a keyboard, and selects only the credit card numbers. How easy is that to do with credit card numbers spoken over a telephone? The key is large-scale automated attacks, not one-time interceptions. -------- Nathaniel Borenstein <nsb@fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq@nsb.fv.com
Nathaniel Borenstein wrote: | > But I just can't believe that he thinks that | the telephone is more secure on average than a keyboard. | | We have a few pages of C code that scan everything you type on a | keyboard, and selects only the credit card numbers. How easy is that to | do with credit card numbers spoken over a telephone? I don't speak my credit card number into the FV line, I DTMF it. Whats more, I do so after the interactive voice system says the words 'credit card.' In fact, a group of people may have been running a tap & scan on FV's line for a long time now, using each number they steal once. Credit cards are crappy financial instruments, made useful mainly by the governments limitations of liability rules. Why defend them? FV's attack is pretty bogus, but no more bogus, and possibly less, than the Power One Time Pads. We're going to see a lot of smoke and mirrors in the next few years regarding security. Anyone have anything to say about RC2? Someone must have written a main() for it? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume
participants (4)
-
Adam Shostack -
Nathaniel Borenstein -
Phil Karlton -
Tim Oerting