Potential Hazards of the Protect America Act

2008-01-25 Thread Perry E. Metzger
Matt Blaze blogs about a paper he, Steve Bellovin, Whit Diffie, Susan Landau, Peter Neumann and Jennifer Rexford have written on the hazards of surveillance technologies: http://www.crypto.com/blog/wiretap_risks/ -- Perry E. Metzger[EMAIL PROTECTED]

Re: Lack of fraud reporting paths considered harmful.

2008-01-25 Thread Perry E. Metzger
[EMAIL PROTECTED] writes: His firm routinely discovers attempted credit card fraud. However, since there is no way for them to report attempted fraud to the credit card network (the protocol literally does not allow for it), all they can do is refuse the transaction -- they literally have no

Re: Dutch Transport Card Broken

2008-01-25 Thread ji
The per-card cost need not be such a big problem. Singapore has a proximity-card-based system. They use the same card both for the long-term cards and for the single-use cards. There is a S$ 2 (IIRC) deposit on the card, which is refunded after the card is used. Waste not want not! /ji

more terrorist crypto hype

2008-01-25 Thread Perry E. Metzger
There has been more hype about Jihadist crypto software lately. For example: http://www.eetimes.com/rss/showArticle.jhtml?articleID=205918680 I'll note that the presumed users would probably be better off with a well vetted program like GPG. I'll also note that there is literally no way to

BSF/DIMACS/DyDAn Workshop on Data Privacy

2008-01-25 Thread Linda Casals
* BSF/DIMACS/DyDAn Workshop on Data Privacy February 4 - 7, 2008 DIMACS/DyDAn Center, CoRE Building, Rutgers University Organizers: Kobbi Nissim, Ben Gurion University, kobbi at cs.bgu.ac.il Benny Pinkas, University of

Re: Dutch Transport Card Broken

2008-01-25 Thread Henryk Plötz
Moin, Am Thu, 24 Jan 2008 20:58:38 -0800 schrieb Aram Perez: Not to defend the designers in any way or fashion, but I'd like to ask, How much security can you put into a plastic card, the size of a credit card, that has to perform its function in a secure manner, all in under 2 seconds (in

Re: Dutch Transport Card Broken

2008-01-25 Thread sbg
How much security can you put into a plastic card, the size of a credit card, that has to perform its function in a secure manner, all in under 2 seconds (in under 1 second in parts of Asia)? And it has to do this while receiving its power via the electromagnetic field being generated by the

Re: Dutch Transport Card Broken

2008-01-25 Thread Aram Perez
Hi Folks, Ed Felten has an interesting post on his blog about a Dutch smartcard based transportation payment system that has been broken. Among other foolishness, the designers used a custom cryptosystem and 48 bit keys. Not to defend the designers in any way or fashion, but I'd like to

Re: Dutch Transport Card Broken

2008-01-25 Thread James A. Donald
Perry E. Metzger wrote: Ed Felten has an interesting post on his blog about a Dutch smartcard based transportation payment system that has been broken. Among other foolishness, the designers used a custom cryptosystem and 48 bit keys. http://www.freedom-to-tinker.com/?p=1250 The Dutch

Re: Dutch Transport Card Broken

2008-01-25 Thread Anne Lynn Wheeler
Aram Perez wrote: Not to defend the designers in any way or fashion, but I'd like to ask, How much security can you put into a plastic card, the size of a credit card, that has to perform its function in a secure manner, all in under 2 seconds (in under 1 second in parts of Asia)? And it has

Re: Dutch Transport Card Broken

2008-01-25 Thread Anne Lynn Wheeler
my impression has been that with lack of takeup of various kinds of security solutions that were extensively marketed in the 90s ... that the current situation has many of those same organizations heavily involved in behind the scenes lobbying saw some of that nearly a decade ago when we were

Re: Dutch Transport Card Broken

2008-01-25 Thread Perry E. Metzger
Aram Perez [EMAIL PROTECTED] writes: Ed Felten has an interesting post on his blog about a Dutch smartcard based transportation payment system that has been broken. Among other foolishness, the designers used a custom cryptosystem and 48 bit keys. Not to defend the designers in any way or

Re: Lack of fraud reporting paths considered harmful.

2008-01-25 Thread lists
Perry wrote: His firm routinely discovers attempted credit card fraud. However, since there is no way for them to report attempted fraud to the credit card network (the protocol literally does not allow for it), all they can do is refuse the transaction -- they literally have no mechanism to