Neat security quote found on slashdot
>From the "Gift Card Hacking" thread, http://slashdot.org/comments.pl?sid=25442&cid=0&pid=0&startat=&threshold=1&mode=flat&commentsort=0&op=Change Re:Nondisclosure (Score:1) by FauxPasIII ([EMAIL PROTECTED]) on Saturday December 29, @12:27PM (#2762484) Businesses are not going to expend money fixing any problem, no matter how severly it affects me as a customer, until it starts to affect their profitability. I wouldn't expect them to; they are a construct created with the express purpose of optimizing profitability. My goal as a security- conscious consumer is to -make- it the corporation's best interest to fix any problems that would have a detrimental effect on me as quickly as possible. (Please, not another full-disclosure flamewar, I just wanted to post this because it seems to summarise the situation nicely). - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
RE: Stegdetect 0.4 released and results from USENET search available
From: Jim Choate <[EMAIL PROTECTED]> I snipped several Cc:s. > > I download all of alt.anonymous.messages from the same news > > server that large numbers of people post and download child > > porn on. > > So the traffic analysis software has your link the first couple of days. > Now all they've got to do is black bag your computers text editors and > news readers...assuming they've got a motivation to expend the effort. The The effort to black bag computers of a few hundred people reading AAM is much more than the effort they spend getting their computers to read it regularly. Or post to it if they chose. > next step is to compare messages you submit with messages others submit, So the TLAs also have to figure out which other ISP accounts and phone lines are also used by the guy they saw reading AAM. More work for them just to rule out AAM robots equipped with a few free ISP accounts. > Cover traffic requires an interesting characteristic to be effective, one > that most don't 'get'; it must be full on all the time. The vast majority > of your expended effort is bogus. It must be independent of the true traffic volume but "full on all the time" is overkill. If an AAM robot posts exactly 50 messages a day that's plenty to cover as much anonymous communication as I could organise in my head. -- ## # Antonomasia ant notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/# ## - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
RE: Stegdetect 0.4 released and results from USENET search available
-- James A. Donald: > > I download all of alt.anonymous.messages from the same > > news server that large numbers of people post and > > download child porn on. On 29 Dec 2001, at 10:19, Jim Choate wrote: > So the traffic analysis software has your link the first > couple of days. Now all they've got to do is black bag your > computers text editors and news readers. I doubt that posting on and receiving from a new server used by tens of thousands of people is sufficient to make US agents risk death to check what is on my computer. And if it is, all the better. We could do with a decent death rate among US agents spying on US residents. The surveillance measures the statists on this list imagine would impose a serious burden even on a totalitarian state. The reason that the Cuban government placed goons visibly listening on every telephone conversation is that invisible listening would have resulted in a flood of information beyond their ability to handle. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG PZszz6Fe2pvgTljDvZy2wdF6LizlaJ8hxFzZ0YVF 42Pmpx9IoC1dTQVlMSPgbQFtO5p9nP+Y2T5MirFTA - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: CFP: PKI research workshop
everyday life has a lot of cryptography ... for instance ... there is quite a bit of cryptography involved in every debit transaction (every time you get money from ATM machine or use point-of-sale terminal). a lot of PKI revolves around the business process of strong authentication where some aspects of cryptography happens to be used. A subset of this saw extremely rapid uptake with regard to SSL and online shopping (again quite a bit of cryptography in use, one might make a case that cryptography should be like electronic dsitributors, everybody may have one ... but very few could actually build one from scratch or even know thay actually have one). One might be tempted to make the observation that uptake rate is much faster if it is filling a new need as opposed to trying to change existing operation. However, PKI industry seems to have tried to make public key cryptography and certificates an "end in themselves". First off, certificates are a solution to strong authentication in an offline environment (aka early '80s offline email paradigm) which doesn't have a very good match to most of the business processes that are in use today. A PIN debit transaction involves the relying-party (the consumer's bank both authenticating and authorizing the transaction authentication based on something you have and something you know ... and authorization on a combination of authentication, available funds, any previous transactions today, the aggregate value of any current day transactions, etc). Digital signature can improve the integrity of the existing PIN-debit based operation and also expand the use to open/insecure network (i.e. the existing PIN-debit is predicated on closed, secure network). This is what NACHA (national cllearing house association ... aka typically regional and national financial industry organizations that provide infrastructure for bank-to-bank wholesale financial transfers) did in the debit demonstration basically upgrading PIN-based cyrptography for authentication to digital-signature cryptography for authentication (where a shared secret paradigm ... aka PIN-base was replaced with a non-shared secret paradigm). http://www.garlic.com/~lynn/index.html#aads There was no certificate necessary ... and, in fact, certificates aren't really about cryptography, there are more about a specific kind of offline business process (which is having difficulty finding a niche in an increasingly online world). Furthermore, not only is the offline-paradigm certificate model having a difficulty finding a niche in an online world ... the idea of a purely authentication business process is possibly having trouble finding its niche ... referencing prior posting that most business tend to perform authentication ... a cost overhead ... as part of some useful, productive business process (not purely an end in itself) http://www.garlic.com/~lynn/aadsm9.htm#cfppki7 One might envision a Monty Python Department of Authentication. Citizens are asked to visit their local Department of Authentication every day, state their name, and provide certificate/credential for proof of their claimed identity. The Department of Authentication doesn't actually record that they've prooved any identity and citizens aren't actually mandated to show up. However, if the citizens do show up everyday to their local Department of Authentication, it makes the DoA employees feel that they are providing a useful service in the scheme of the universe (as well as certificates/credentials that are voluntarily verified everyday are better than ones that aren't ... something like pet rocks). Now, an interesting thing might be regarding rapid uptake of general security. One could contend that majority of the market believes that good, strong security should be an attribute of the basic infrastructure ... somewhat like the issue of automobile quality in the '70s, not going to pay any more for it ... but would migrate to a manufactor that had significantly better quality. You then have the 1) vendors that don't see quality as worth while since they won't be able to charge more 2) new vendors that would like to sell "quality" as a stand-alone attribute ... not actually having to manufactor automobiles but somehow convince customers that they can sell quality independent of any product, and 3) vendors that feel that they can eventually gain market share by providing better quality. Substitute "security" and/or "PKI" in place of "quality". Part of the issue is that security (and strong authentication) should be an attribute of the basic infrastructure ... not something that exists by itself in a vacuum. [EMAIL PROTECTED] on 12/28/2001 6:54 wrote: Several of the comments about the slow uptake of PKI touch on what seem to be two basic factors that are responsible for this phenomenon: 1. Cryptography does not fit human life styles easily. As an example, truly secure systems would stop secretaries from forging their b
RE: Stegdetect 0.4 released and results from USENET search available
On Fri, 28 Dec 2001 [EMAIL PROTECTED] wrote: > I download all of alt.anonymous.messages from the same news > server that large numbers of people post and download child > porn on. So the traffic analysis software has your link the first couple of days. Now all they've got to do is black bag your computers text editors and news readers...assuming they've got a motivation to expend the effort. The next step is to compare messages you submit with messages others submit, with respect to time not source/destination, once they've a correlation they can then move to 'other' techniques (eg trap mail, phone taps, etc.). > (Hey, I do not read anything in > alt.anonymous messages, I am just generating cover traffic > out of pure public spirit.) > > Thus there is no ongoing pattern. Only because your 'cover traffic' isn't. If you wanted to help with cover traffic then you'd be sending large quantities of bogus traffic to the group daily.w But that would take a concerted commitment. Cover traffic requires an interesting characteristic to be effective, one that most don't 'get'; it must be full on all the time. The vast majority of your expended effort is bogus. The most effective cover traffic model is to send nothing but cover traffic at your full bandwidth 24x365. Then randomly inject/replace cover traffic with real traffic as it comes in. ps I'm still working on your Chomsky claims... -- Day by day the Penguins are making me lose my mind. Bumper Sticker The Armadillo Group ,::;::-. James Choate Austin, Tx /:'/ ``::>/|/ [EMAIL PROTECTED] www.ssz.com.', `/( e\ 512-451-7087 -~~mm-'`-```-mm --'- - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
RE: Stegdetect 0.4 released and results from USENET search available
At 02:47 PM 12/28/01 -0800, Bill Stewart wrote: >At 01:59 PM 12/28/2001 -0800, David Honig wrote: >>A.A.M + PGP = covert radio transmitter which sends coded messages. Obviously >>interesting, so you direction-find to defeat the anonymity. > >And Perry replied: >>[Moderator's note: And how would you possibly do that? --Perry] Anonymity, like much of crypto or security, is an arms race. A radio TX would try bursty sending. So the DXer must keep his receivers going all the time. So the TXer has to move to a different place each time he sends. So the DXer needs a larger mesh of receiver stations and faster response; recording travel (license plate cams, requiring ID on busses) helps too. Ultimately the DXer can do a physical search on everyone. So the TXer has to embed the transmitter in his body. So the DXer has to X-ray everyone, etc. Faster foxes lead to faster rabbits which lead to faster foxes. Similarly with "anonymous" IP broadcast. Place enough surveillance cameras, subvert enough ISPs/remailers, deploy enough trojans, do enough traffic analysis, and strong anonymity takes much more effort. At that point the extra effort for stego might have been a good tradeoff. The point of stego, it seems to me, is to not attract such attention in the first place. Although *if* you're already on someone's "Watch List" there may be little point. Another example: You could have an encrypted, deniable filesystem with duress passphrases, etc. But you still have to deal with Mr. Happy-Fun Customs Agent who wants to know what kind of naughty bits you're importing. A collection of baby pictures requires no explanation, no special flag in the records that track you. >So tracing a single transmission may be hard, but tracing an ongoing pattern >is easier, Exactly. > unless there's a trusted Usenet site in some >country where you don't have jurisdiction problems. And is out of range of the guided missile which was "accidentally" mistargeted due to "out of date" maps. And which doesn't need to interact with the US financial tentacles. Which can maybe survive a physical embargo. Whose sysop is immune from coercion or bribery. >That means that A.A.M + PGP is fine for an occasional >"Attack at Dawn" message, but not necessarily for routine traffic. Yes --much like a covert radio transmitter. "Love work, hate domination, and do not let your name come to the attention of the ruling powers." -Talmud/Sayings of the Fathers - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
RE: Stegdetect 0.4 released and results from USENET search available
-- On 28 Dec 2001, at 14:47, Bill Stewart wrote: > Reader anonymity depends a lot on how many people actually > read A.A.M, and on how many sites keep NNTP logs - it > probably a lot fewer readers than the largest binary porn > spam groups, but a lot also depends on how many small ISPs > around the world still spool their own news rather than > buying access from news services. It's certainly harder to > trace than senders. > > So tracing a single transmission may be hard, but tracing > an ongoing pattern is easier I download all of alt.anonymous.messages from the same news server that large numbers of people post and download child porn on. My software always downloads all new messages in alt.anonymous.messages irrespective of whether I am looking for a particular message. (Hey, I do not read anything in alt.anonymous messages, I am just generating cover traffic out of pure public spirit.) Thus there is no ongoing pattern. This system was first described a very long time ago in "true names" --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG WaGBISA1ObM2v9DUT5dgMhF7a8QfnHz1GwISf94v 4eKunzkdsCm+yDzSimzsw5nvwZctZg3NdD5VDl8v0 - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
