Re: CFP: PKI research workshop

2002-01-13 Thread lynn . wheeler
to be fair ... most commercial CA's have to verify with the domain name infrastructure as to the owner of the domain name ... before issuing a SSL domain name server cert. Note however, one of the justifications for having SSL domain name server cert is because of concerns with regard to domain n

Re: CFP: PKI research workshop

2002-01-13 Thread Derek Atkins
Michael Sierchio <[EMAIL PROTECTED]> writes: > Carl Ellison wrote: > > > If that's not good enough for you, go to https://store.palm.com/ > > where you have an SSL secured page. SSL prevents a man in the middle > > attack, right? This means your credit card info goes to Palm > > Computing, rig

Re: CFP: PKI research workshop

2002-01-13 Thread Carl Ellison
At 11:31 AM 1/12/2002 -0800, Michael Sierchio wrote: >Carl Ellison wrote: > >> If that's not good enough for you, go to https://store.palm.com/ >> where you have an SSL secured page. SSL prevents a man in the >> middle attack, right? This means your credit card info goes to >> Palm >> Computing,

Re: CFP: PKI research workshop

2002-01-13 Thread Michael Sierchio
Carl Ellison wrote: > If that's not good enough for you, go to https://store.palm.com/ > where you have an SSL secured page. SSL prevents a man in the middle > attack, right? This means your credit card info goes to Palm > Computing, right? Check the certificate. To be fair, most commercial

Re: CFP: PKI research workshop

2002-01-13 Thread Eric Rescorla
Carl Ellison <[EMAIL PROTECTED]> writes: > If that's not good enough for you, go to https://store.palm.com/ > where you have an SSL secured page. SSL prevents a man in the middle > attack, right? This means your credit card info goes to Palm > Computing, right? No. It means that your credit card

Re: CFP: PKI research workshop

2002-01-13 Thread Carl Ellison
At 05:45 PM 12/26/2001 -0500, Perry E. Metzger wrote: > > >"Phillip Hallam-Baker" <[EMAIL PROTECTED]> writes: >> Methinks you complain too much. >> >> PKI is in widespread use, it is just not that noticeable when you >> use it. This is how it should be. SSL is widely used to secure >> internet pa

Liability issues in computer security

2002-01-13 Thread Peter Gutmann
For those who don't normally read it, the December issue of ;login (which you'll eventually be able to get at http://www.usenix.org/publications/login/ if you're not a member) has a nice legal analysis of the issue of liability for negligent computer security. It's probably the best (and certainl

Password Safe (was Re: The Scout Report -- January 11, 2002)

2002-01-13 Thread R. A. Hettinga
At 5:05 PM -0600 on 1/11/02, Internet Scout Project wrote: > 16. Counterpane Labs: Password Safe > http://www.counterpane.com/passsafe.html > > Tired of trying to memorize numerous computer passwords? Password Safe is a > free Windows 9x/2000 utility that provides users the opportunity to keep

Norway Cracks Down on DVD Hacker

2002-01-13 Thread R. A. Hettinga
http://www.wired.com/news/politics/0,1283,49638,00.html Norway Cracks Down on DVD Hacker By Declan McCullagh 11:20 a.m. Jan. 10, 2002 PST WASHINGTON -- Jon Johansen, a Norwegian teen hacker, has been indicted for allegedly bypassing DVD anti-copying technology. On Thursday, newspapers in Nor

Norway Indicts Teen Who Published Code Liberating DVDs

2002-01-13 Thread R. A. Hettinga
http://www.eff.org/IP/Video/DeCSS_prosecutions/Johansen_DeCSS_case/20020110_eff_pr.html Electronic Frontier Foundation Media Release Norway Indicts Teen Who Published Code Liberating DVDs U.S. Entertainment Industry Pressured Norwegian Prosecutors For Immediate Release: Thursday, January 10,

High-tech Thieves Snatch Data From ATMs

2002-01-13 Thread R. A. Hettinga
http://dailynews.yahoo.com/htx/abc/20020110/bs/atmfraud020110_1.html Thursday January 10 03:26 PM EST High-tech Thieves Snatch Data From ATMs By Paul Eng ABCNEWS.com Thieves can steal an account number from an ATM or debit card, and secret pin. At the corner market, the skim is in

credit card & gift card fraud (from today's comp.risks).

2002-01-13 Thread lynn . wheeler
other postings and recent info from comp.risks: http://www.garlic.com/~lynn/aadsm9.htm#carnivore3 Shades of FV's Nathaniel Borenstein: Carnivore's "Magic Lantern" http://www.garlic.com/~lynn/2002.html#19 Buffer overflow http://www.garlic.com/~lynn/2002.html#20 Younger recruits versus experienced

Re: On ISPs Not Filtering Viruses

2002-01-13 Thread plambert
At 1:46 PM -0800 1/7/02, John Gilmore wrote: >I thought ISPs were supposed to be bit-pipes. End-to-end unrestricted >connectivity is the basic feature of the Internet. This feature is >what made the Internet superior to every preceding network. If my ISP >was filtering my mail or my packets, I'

ANNOUNCE: Introduction to OpenSSL Programming 20020110

2002-01-13 Thread Eric Rescorla
http://www.rtfm.com/openssl-examples We are happy to announce the availability of the January 10, 2002 edition of "An Introduction to OpenSSL Programming", containing a pair of articles describing how to use OpenSSL for common programming tasks, complete with documented, complete, and compilable

Re: Hackers Targeting Home Computers

2002-01-13 Thread Kent Borg
On Wed, Jan 09, 2002 at 04:32:44PM -0700, [EMAIL PROTECTED] wrote: > an easy justification is possibly 90+percent of ISP customers in the > world have contracts that preclude "server" operation. But that is an annoying limitation to begin with--and not just for people trying to be the next Yahoo.

Re: FreeSWAN & US export controls

2002-01-13 Thread John Gilmore
> Or is there something we should be doing to get RedHat, and Debian, and > other US-based distributions to include it? Absolutely. It's already pretty secure. We should just make it trivial to install, automatic, transparent, self-configuring, painless to administer, and free of serious bugs.

Re: FreeSWAN & US export controls

2002-01-13 Thread Sandy Harris
John Gilmore wrote: > > Anonymous said: > > The major problem that holds back the development of FreeS/WAN is > > with its management. [Management that cares more about sitting on > > its pulpit, than getting useful software into the hands of people.] > > Unless things have changed recently, the