Re: Dell to Add Security Chip to PCs

2005-02-04 Thread Steven M. Bellovin
problems that aren't solvable with today's technology? Other than protecting keys -- and, of course, DRM -- I'm very far from convinced of it. The fault, dear Brutus, is not in our stars but in ourselves. --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

Re: Dell to Add Security Chip to PCs

2005-02-04 Thread Steven M. Bellovin
problems that aren't solvable with today's technology? Other than protecting keys -- and, of course, DRM -- I'm very far from convinced of it. The fault, dear Brutus, is not in our stars but in ourselves. --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

Re: The Reader of Gentlemen's Mail, by David Kahn

2005-01-09 Thread Steven M. Bellovin
of Yardley's success with women. I have no idea if that's true, though moralistic revulsion may be closer. But I wonder if the root of the personal antagonism may be more that of the technocrat for the manager... --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

Re: The Reader of Gentlemen's Mail, by David Kahn

2005-01-09 Thread Steven M. Bellovin
of Yardley's success with women. I have no idea if that's true, though moralistic revulsion may be closer. But I wonder if the root of the personal antagonism may be more that of the technocrat for the manager... --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

Re: Attacking networks using DHCP, DNS - probably kills DNSSEC

2003-06-29 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Simon Josefsson writes: Of course, everything fails if you ALSO get your DNSSEC root key from the DHCP server, but in this case you shouldn't expect to be secure. I wouldn't be surprised if some people suggest pushing the DNSSEC root key via DHCP though, because

Re: Attacking networks using DHCP, DNS - probably kills DNSSEC

2003-06-28 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Bill Stewart writes: Somebody did an interesting attack on a cable network's customers. They cracked the cable company's DHCP server, got it to provide a Connection-specific DNS suffic pointing to a machine they owned, and also told it to use their DNS server. This

Re: An attack on paypal

2003-06-12 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Matt Crawford writ es: The worst trouble I've had with https is that you have no way to use host header names to differentiate between sites that require different SSL certificates. True as written, but Netscrape ind Internet Exploder each have a hack for honoring

Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Period (was Re: BNA's Internet Law News (ILN) - 2/27/03)

2003-03-05 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], R. A. Hettinga wr ites: --- begin forwarded text Status: RO From: Somebody To: R. A. Hettinga [EMAIL PROTECTED] Subject: Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Perio d (was Re: BNA's Internet Law News (ILN) - 2/27/03) Date: Sun, 2 Mar 2003

Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Period (was Re: BNA's Internet Law News (ILN) - 2/27/03)

2003-03-05 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], R. A. Hettinga wr ites: --- begin forwarded text Status: RO From: Somebody To: R. A. Hettinga [EMAIL PROTECTED] Subject: Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Perio d (was Re: BNA's Internet Law News (ILN) - 2/27/03) Date: Sun, 2 Mar 2003

Re: Did you *really* zeroize that key?

2002-11-07 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Peter Gutmann writes : [Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. [Moderator's note: I'd be curious to hear a summary -- it

Re: DOJ proposes US data-rentention law.

2002-06-20 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], David G. Koontz writes: Trei, Peter wrote: - start quote - Cyber Security Plan Contemplates U.S. Data Retention Law http://online.securityfocus.com/news/486 Internet service providers may be forced into wholesale spying on their customers as part of the