vipul.net · Domains · Slashdot Mirror

Re:Spam is dying by Illbay · 2003-11-02 22:57 · Score: 1 · on Spammer DDoS-By-Virus On spamhaus.org

I have only my tiny SOHO email server (Red Hat 9; Sendmail) to go by, personally, but a simple implementation of SpamAssassin plus some open source Procmail scripts have pretty much eliminated Spam and Virii from our lives.

Poor Symantec AV hardly has anything to do any more.

Oh, and I also use RICOCHET to try to make the spammers' lives a little more miserable than they undoubtedly already are (being a "spammer" is its own reward, I think).

BlackNet? Assassination Politics? by plcurechax · 2003-07-29 01:19 · Score: 2, Interesting · on Pentagon Lets You Bid on Terrorism?

This sounds like it could be abused to become a BlackNet

an experiment in information markets, using anonymous message pools for exchange of instructions and items. Tim May's experiment in guerilla ontology.

Or actually a bit more like Jim Bell's Assassination Politics, which is a scheme that allows murder for hire under the pretext of a lottery.

Challenge Response is a DDoS tool. by vipul_ved_prakash · 2003-05-07 12:12 · Score: 1 · on Earthlink Deploying Challenge-Response Anti-Spam System

Challenge/Response is a DDoS tool hidden in an anti-spam system. Consider this scenario: mallory@spamcompany.com sends out a million spams in which he puts alice@wonderland.com in the "From" field. Those running a challenge/Response tool automatically send out a challenge to alice@wonderland.com on receipt of this spam. If there were 10,000 people running a challenge/response tool, Alice will receive 10,000 challenges! If all of these had 10k+ graphics in them (as they usually do), Alice would receive 100Mb of mail in a matter of few minutes. This might disrupt Alice's mail servers, cause her to lose legitimate mail, waste several hours of her time, and quite likely force Alice (or her mail administrator) to drop all future challenges generated by Challenge/Response softwares involved in the incident; even those sent on receipt of emails that were written by Alice. (See my complete response to PC Magazine reviewers on whitelisting and Challenge/Response here)

Re:I'm not sure.. by IvyMike · 2003-02-08 21:25 · Score: 4, Informative · on Cashless Society

Someone could just probably figure out how money is "stored" and just keep on replenishing. Note the card is anonymous.

David Chaum's digicash system was a good solution to this problem. He developed a system of completely anonymous (even to the bank) e-cash. The executive summary is: using techniques common in encryption, the cash is unforgeable and can be spent once. If you spend the cash twice, there's a random challenge-response sequence you have to go through each time, and you will have now revealed enough information that you're no longer anonymous, and the fact that the money is being double-billed is detected and prevented.

Googling for "Chaum" and "digicash" gets you a lot of articles which explain the system (which is quite complex) in a level of detail beyond that which is appropriate for slashdot. :) It's a bit hard to believe (at least without going through the math yourself) that it's both anonymous and unforgeable, but that's the beauty of it. There are also quite a few articles about Chaum's company "Digicash" which appears to have been poorly managed. That doesn't change the fact that the mathematics behind digicash are sound.

Merkac Dot - Google Links, Slashdot Summary by mikecheng · 2002-12-16 12:13 · Score: 1 · on Tech's Answer To Big Brotherism

Merkac Dot : 48153

Links to Google Cache(N.B. Not always cached.)

C|Net has an interesting editorial cache [Link not cached at time of posting]
Declan McCullagh cache [Cache link active]
Digital Cash. cache [Link not cached at time of posting]

Mirrored Text (for posterity, not karma): Digital Cash.

Implementations of various electronic cash protocols. Digital Cash Implementations of various electronic cash protocols.

magicmoney 1.0 Magic Money is a digital cash system designed for use over electronic mail. Magic Money is a digital cash system designed for use over electronic mail.The system is online and untraceable. Online means that each transactioninvolves an exchange with a server, to prevent double-spending. Untraceablemeans that it is impossible for anyone to trace transactions, or to match awithdrawal with a deposit, or to match two coins in any way. The systemconsists of two modules, the server and the client. Magic Money uses the PGPascii-armored message format for all communication between the server andclient. All traffic is encrypted, and messages from the server to the clientare signed. Untraceability is provided by a Chaum-style blind signature.Note that the blind signature is patented, as is RSA. Using it forexperimental purposes only shouldn't get you in trouble. Digicash isrepresented by discrete coins, the denominations of which are chosen by theserver operator. Coins are RSA-signed, with a different e/d pair for eachdenomination. The server does not store any money. All coins are stored bythe client module. The server accepts old coins and blind- signs new coins,and checks off the old ones on a spent list. sources MagicMoney.tar.gz author Pr0duct Cypher edit application object

-lucre 0.9.0 Unofficial Cypherpunks Release of Chaum's ecash. -lucre is a C library that implements the protocols of DigiCash's ecash.-lucre provides all of the basic things you would like (payment requests,payments, deposits, withdrawals, opening accounts), as well as a fewadvanced features (like the ability to use the same account on multiplemachines, and the ability to use ecash without having a bank account atall). The format of the wallet is somewhat different from that of DigiCash'sstandard client, so you have to be careful if you want to use use both thatand -lucre with the same bank account. It does seem to work, though. sources lucre-0.9.0.tar.gz author Anonymous edit application object

ncash 19971216 An efficient off-line electronic cash system based on the representation problem. Experimental implementation of an off-line electronic cash system based onthe representation problem. From the documentation, "Our system is the firstto be based entirely on descrete logarithms. Using the representationproblem as a basic concept, some techniques are introduced that enable us toconstruct protocols for withdrawl and payment that do not use the cut andchoose methodology of earlier systems. As a concequence, our cash system ismuch more efficient in both computation and communication complexity thanpreviously proposed systems.". The technical paper is mirroredhere. sources snapshot.tar.gz author Niels Möller homepage http://www.lysator.liu.se/~nisse/NCash/NCash.html edit application object

$Id: application-index.html,v 0.24 1999/09/16 14:13:43 root Exp $ munitions.vipul.net Amsterdam, Netherlands mirror &copy 1999-2001, Vipul Ved Prakash. Thanks to xs4all for providing the resoruces to host this site.

Mirrored Text (for posterity, not karma): C|Net has an interesting editorial

Perspective: Tech's answer to Big Brother - Tech News - CNET.com CNET tech sites: Price comparisons | Product reviews | Tech news | Downloads | Site map News.context: Special Reports | Newsmakers | Perspectives Perspective: Tech's answer to Big Brother By Declan McCullagh December 16, 2002, 4:00 AM PT WASHINGTON-Why is everyone so surprised that the U.S. government wants to create a Total Information Awareness database with details about everything you do?

This is an unsurprising result of having so much information about our lives archived on the computers of our credit card companies, our banks, our health insurance companies and government agencies.

Now a Defense Department agency is devising a way to link these different systems together to create a kind of digital alter ego of each of us. After the Sept. 11 terrorist attacks, this proposed centralization was inevitable-and it's only going to get worse.

Blame retired Admiral John Poindexter, national security adviser for former President Ronald Reagan, who returned to the Pentagon in February to run a creepy new agency that's trying to create this mammoth surveillance and information-analysis system. It's called Total Information Awareness, and it's funded by the Defense Advanced Research Projects Agency (DARPA).

Don't get me wrong. I'm not saying it's a good idea, or that it's consistent with the traditional American values of limited government and a sharp demarcation between the private and the public sector. I'm not even sure if Poindexter's brainchild could ever work.

What I am saying is that if our personal information-some of it extraordinarily sensitive-is archived in corporate or government databases and protected only by the weak shield of the law, it's vulnerable to federal snoops.

After the Sept. 11 terrorist attacks, this proposed centralization was inevitable-and it's only going to get worse. When a nation is responding to perilous threats, politicians tend to repeal privacy laws in a femtosecond. The current process started with overwhelming votes for the USA Patriot Act last year. (It cleared the Senate with only one "nay" vote, from the courageous Russ Feingold, D-Wisc.) And if another terrorist attack happens, all bets are off.

That's why simply enacting laws and trusting to the government to protect our privacy can be a very dangerous thing. Just ask the Japanese-Americans forced into internment camps during World War II. New research says they were selected using Census Bureau data-data that was handed over to the government in strict confidence. Or ask the people who were robbed by the former chief of detectives for the Chicago Police Department, who pleaded guilty last year to using law enforcement databases to plot crimes.

Technology offers a better way to preserve our rights against government overreaching. New crises may prompt Congress to vote unanimously to skewer the Bill of Rights. But technological protections don't vary with the whims of politicians or shifts in Supreme Court majorities.

The sad thing is that for years we've known about technology that can slow down this mass "databasification" of American society. We just haven't used it.

One approach is outlined in Peter Wayner's useful book, "Translucent Databases." It describes methods-complete with Java code that produces standard SQL (Structured Query Language)-to construct databases that use one-way functions to scramble data and shield it from prying eyes.

New crises may prompt Congress to vote unanimously to skewer the Bill of Rights. But technological protections don't vary with the whims of politicians or shifts in Supreme Court majorities. "The main goal I had with writing the book is to show it is possible to build a database that does useful work and solves problems without keeping personal information," Wayner said. "At first it seems counterintuitive. You figure that if you're going to arrange appointments and keep track of what customers bought in the past, you need the information there. But it turns out it's possible (to scramble it), and it can make the database smaller and faster, too."

A basic example is the venerable Unix password file, which doesn't store any actual passwords. Instead, the operating system scrambles a user's password using a one-way hash function and saves the scrambled version to the file. Because the function cannot be reversed, the database is secure if viewed by a malicious hacker, but users can still log in.

More importantly, even if Poindexter obtained that file through a court order or some more surreptitious method, assuming the encryption algorithm worked properly, he wouldn't be able to extract anyone's actual passwords from it.

Wayner's book provides tips that more programmers should follow. He shows how to build an encrypted department store database using a one-way function that can't divulge personal information unless a customer's full name is supplied. Other examples include encrypted car rental databases and lotteries.

A second approach was invented by Stefan Brands, previously a scientist at Zero Knowledge Systems, who outlined it in a book titled "Rethinking Public Key Infrastructures and Digital Certificates: Building in Privacy."

Brands describes a remarkable technology called limited disclosure certificates. It's a pre-emptive response to current trends in authentication, where you might end up using one digital ID certificate for everything from driving to shopping to health care-and all your information and transactions would instantly appear in Poindexter's database.

Limited disclosure certificates solve that centralization problem. They use a clever bit of mathematics to protect the identity of honest people, but reveal the identity of people who attempt to commit fraud. As soon as you try to cheat someone, the privacy protection evaporates.

Brands predicts in his book how a limited disclosure certificate would work on a smart card: "Any data leakage from and to the smart card can be blocked. The cardholder can even prevent his or her smart card from developing information that would help the card issuer to trade the cardholders' transactions, should the card contents become available to the card issuer. Transactions can be completed within as little as 1/20th of a second, so that road-toll and public transport applications are entirely feasible."

In an interview, Brands added that "instead of all this information about you being managed in central databases, you could manage it yourself. In theory, all the data that organizations hold about you and need to make decisions about you could be distributed to you.

"If you use good cryptography, the organizations' information is protected: You can't modify the information. At the same time, you would then be able to disclose whatever you need for a particular purpose."

MIT professor Ron Rivest described Brands' work as imparting a way for people to remain anonymous and yet convince an Internet service provider that they are a paid subscriber. The beauty is that the user's sessions are unlinkable-the ISP can't even tell if an user currently logged in is the same as the user who used the service at a previous time.

It's true that Congress could outlaw Wayner's and Brands' techniques and force all information to be stored in a surveillance-enabled way. But until that happens, we don't have to make it any easier for Poindexter and his snoops.

More Perspectives

biography Declan McCullagh is the Washington correspondent for CNET News.com, chronicling the ever-busier intersection between technology and politics. Before that, he worked for several years as Washington bureau chief for Wired News. He has also worked as a reporter for The Netly News, Time magazine and HotWired. Search News.com All CNET The Web