Re: SIGINT planes vs. radioisotope mapping

2003-06-08 Thread Major Variola (ret)
t 10:23 AM 6/6/03 -0700, Tim May wrote: I certainly never implied in any way that a simple G-M tube would be useful for this. Implicit in my radioistope mapping comment was that a gamma ray spectrometer would be used. And note that this is just what can be easily bought on the open

Re: SIGINT planes vs. radioisotope mapping

2003-06-08 Thread BobCat
From: Tim May [EMAIL PROTECTED] I certainly never implied in any way that a simple G-M tube would be useful for this. Implicit in my radioistope mapping comment was that a gamma ray spectrometer would be used. The rest of the assembly, even 20 years ago, was mostly portable: the germanium

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Frederick Hirsch
Rich Salz wrote: Perhaps a few best practices papers are in order. They might help the secure (distributed) computing field a great deal. /r$ -- The new book, Practical Cryptography, by Niels Ferguson and Bruce Schneier is useful. regards, Frederick

The real problem that https has conspicuously failed to fix

2003-06-08 Thread James A. Donald
I keep posting you cannot do this using https, and people keep = replying yes you can No you cannot, cause if you could, paypal, e-gold, e-bay, and the rest = would not be suffering from the problem illustrated by scam mails such = as the following (When you hit the submit button, guess what

CIA spies shun computers

2003-06-08 Thread Steve Schear
Old technology dominates at the CIA In the movies, spies and intelligence agents are the ones with the cool gadgets and state-of-the-art equipment, but their real life counterparts are far behind. http://news.bbc.co.uk/2/hi/technology/2965620.stm A Jobless Recovery is like a Breadless

Re: An attack on paypal

2003-06-08 Thread Anne Lynn Wheeler
At 11:43 PM 6/8/2003 +0100, Dave Howe wrote: HTTPS works just fine. The problem is - people are broken. At the very least, verisign should say ok so '..go1d..' is a valid server address, but doesn't it look suspiously similar to this '..gold..' site over here? for https://pseudo-gold-site/ - but

You bought it, Who controls it? [TR Article]

2003-06-08 Thread Major Variola (ret.)
article by Edward Tenner, Technology review, June 2003 p61-64 Also an article on deceipt detector p67-69 about using IR reflectivity of your frontal lobes to detect deceipt. Sort of a polygraph on steroids. (sorry, only cites, not URLs this time)

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Jaap-Henk Hoepman
I thought the 3G (UMTS) cellphones at least were going to use reasonably good crypto; don't know about the overall security architecture though. Jaap-Henk On Fri, 06 Jun 2003 14:30:04 -0400 Ian Grigg [EMAIL PROTECTED] writes: John Kelsey wrote: So, what can I do about it, as an individual?

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Eric Rescorla
[EMAIL PROTECTED] (Peter Gutmann) writes: Bodo Moeller [EMAIL PROTECTED] writes: Using an explicit state machine helps to get code suitable for multiplexing within a single thread various connections using non-blocking I/O. Is there some specific advantage here, or is it an academic

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Tim Dierks
At 10:09 PM 6/4/2003, James A. Donald wrote: Eric Rescorla Nonsense. One can simply cache the certificate, exactly as one does with SSH. In fact, Mozilla at least does exactly this if you tell it to. The reason that this is uncommon is because the environments where HTTPS is used are generally

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Ian Grigg
John Kelsey wrote: So, what can I do about it, as an individual? Make the cellphone companies build good crypto into their systems? Any ideas how to do that? Nope. Cellphone companies are big slow moving targets. They get their franchise from the government. If the NSA wants weak crypto,

Re: Maybe It's Snake Oil All the Way Down

2003-06-08 Thread Anne Lynn Wheeler
At 04:42 PM 6/4/2003 -0700, Eric Rescorla wrote: Nonsense. One can simply cache the certificate, exactly as one does with SSH. In fact, Mozilla at least does exactly this if you tell it to. The reason that this is uncommon is because the environments where HTTPS is used are generally spontaneous