Re: [cryptography] Must have seemed like a good idea at the time

2013-07-25 Thread Jeffrey Walton
On Tue, Jul 23, 2013 at 4:54 AM, ianG wrote: >> ... > > Banks will say that international wires are irreversible, but it isn't true. > If the banks cooperate they can do a return of funds. It all depends... > This was kind of interesting: "According to Li, the larger problem [of Chinese car theft

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-23 Thread Randall Webmail
From: "ianG" >Banks will say that international wires are irreversible, but it isn't >true. If the banks cooperate they can do a return of funds. It all >depends... Banks are not bound by natural laws. Try to convince your depository bank that the bank which missed its midnight deadline on

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-23 Thread Karsten Nohl
On Jul 22, 2013, at 7:48 , ianG wrote: > On 22/07/13 02:27 AM, James A. Donald wrote: >> On 2013-07-22 9:01 AM, Randall Webmail wrote: >>> >>> [SNIP] >>> To derive a DES OTA key, an attacker starts by sending a binary SMS to >>> a target device. The SIM does not execute the improperly signed OT

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-23 Thread ianG
On 22/07/13 23:33 PM, Florian Weimer wrote: * James A. Donald: This not all that fatal, as the money is traceable, but it means that the financial institution needs an apparatus to reverse cell phone transactions, and that cell phone money is therefore soft on the may scale. This has been the

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-22 Thread Florian Weimer
* James A. Donald: > This not all that fatal, as the money is traceable, but it means that > the financial institution needs an apparatus to reverse cell phone > transactions, and that cell phone money is therefore soft on the may > scale. This has been the case for giro payments for a while, and

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-21 Thread ianG
Also here: http://www.forbes.com/sites/parmyolson/2013/07/21/sim-cards-have-finally-been-hacked-and-the-flaw-could-affect-millions-of-phones/ On 22/07/13 02:27 AM, James A. Donald wrote: On 2013-07-22 9:01 AM, Randall Webmail wrote: [SNIP] To derive a DES OTA key, an attacker starts by sendin

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-21 Thread grarpamp
> A number of projects have been launched to use cell phones as a money > device, a smart card. I am pretty sure if your malware can send sms, it can > transfer funds. > > This not all that fatal, as the money is traceable, but it means that the > financial institution needs an apparatus to revers

Re: [cryptography] Must have seemed like a good idea at the time

2013-07-21 Thread James A. Donald
On 2013-07-22 9:01 AM, Randall Webmail wrote: [SNIP] To derive a DES OTA key, an attacker starts by sending a binary SMS to a target device. The SIM does not execute the improperly signed OTA command, but does in many cases respond to the attacker with an error code carrying a cryptographic s

[cryptography] Must have seemed like a good idea at the time

2013-07-21 Thread Randall Webmail
[SNIP] To derive a DES OTA key, an attacker starts by sending a binary SMS to a target device. The SIM does not execute the improperly signed OTA command, but does in many cases respond to the attacker with an error code carrying a cryptographic signature, once again sent over binary SMS. A r