Another entry in the internet security hall of shame....

[John Kelsey]

Guys,

Recently, Earthlink's webmail server certificate started showing up as expired. 
 (It obviously expired a long time ago; I suspect someone must have screwed up 
in changing keys over or something, because the problem wasn't happening up 
until recently.)  So, I contacted Earthlink's technical support, and I got this 
really encouraging reply



/
Dear John Kelsey,

Thank you for contacting us.

I understand that you are having problems viewing Webmail and that it send out 
an
error on SSL certificate.

I suggest that you try lowering the security settings of your Internet Explorer.
Please follow the steps below on how to lower the security settings on your 
Internet
Explorer.

1. Open Internet Explorer.
2. On the Task panel click on Internet Options.
3. Click on the Advance Tab.
4. Scroll down and uncheck [Warn about invalid site certificates].
5. Remember to click on Apply.
6. Click on OK.

You have successfully lower your Internet Explorer settings.

Should you have any other concerns, please get back to us. You will receive a 
prompt
reply.

Sincerely,

Therese B. 3613
EarthLink Electronic Customer Support
EarthLink, Inc.
Case ID 69080634

Looking for easy access to news, stocks, sports, and your favorite links?
With the EarthLink Personal Start Page you can customize everything from
the background colors to your local weather. For more information please
visit http://start.earthlink.net

Resolve your customer service questions on-line at our Account maintenance
web site. To add email mailboxes, change passwords, or update your credit
card information, go to:
http://myaccount.earthlink.net

You can also trade real-time messages with one of our friendly Live Chat
representatives:
http://support.earthlink.net/chat

Or email us and get a response that day:
http://support.earthlink.net/email

Original Message Follows:
-

*   Presented Article: 142454
*   Name: John Kelsey
*   Email: [EMAIL PROTECTED]
*   Account Type: EarthLink Experience
*   Issue: Spam/Internet Fraud Problem
*   Detailed Issue: Report an Issue
*   Article Title: Protecting Yourself Against Email/Internet Fraud
*   Message Body: The SSL certificate for webmail.earthlink.net is
expired. The webmail.atl.earthlink.net certificate is fine, it's just
the webmail.earthlink.net certificate.

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

[Clips] RSA Security Sees Hope in Online Fraud

[R.A. Hettinga]

--- begin forwarded text


 Delivered-To: [EMAIL PROTECTED]
 Date: Tue, 23 Aug 2005 09:01:29 -0400
 To: Philodox Clips List <[EMAIL PROTECTED]>
 From: "R.A. Hettinga" <[EMAIL PROTECTED]>
 Subject: [Clips] RSA Security Sees Hope in Online Fraud
 Reply-To: [EMAIL PROTECTED]
 Sender: [EMAIL PROTECTED]

 

 Technology Review


 TechnologyReview.com

  RSA Security Sees Hope in Online Fraud
  By Brian Bergstein   August 22, 2005




  AP Technology Writer

 BEDFORD, Mass. (AP) -- It was a Friday afternoon for the computer
 encryption folks at RSA Security Inc., and summertime greenery filled the
 countryside view from Art Coviello's office.

 Even so, the RSA chief could have been excused if he didn't seem relaxed.

 RSA had just announced its second straight set of quarterly results that
 didn't dazzle Wall Street analysts, and RSA's stock was flirting with a
 52-week low.

 But Coviello shrugged it off. Analysts, schmanalysts. More importantly, he
 said, lots of factors are about to turn in RSA's favor, namely the need for
 more secure, traceable financial transactions in a world beset by online
 fraud and identity theft.

 "The whole thing's moving a lot more slowly than it ought to," Coviello
 said. "We've got to keep pounding and pounding until we reach a tipping
 point, and we will take advantage of it."

 The lack of an obsession over quarterly results isn't the only unusual
 thing about RSA, which still bears the marks of an academic past despite
 being a $300 million company with 1,200 employees and customers in
 government, banking and health care.

 RSA is named for three Massachusetts Institute of Technology professors,
 Ron Rivest, Adi Shamir and Len Adelman. Though they are no longer involved
 with the company they founded in 1986, their invention of a seminal method
 of cryptography set the tone for the company and is crucial in online
 commerce.

 Today RSA is perhaps best known for staging a prestigious annual security
 conference and for selling 20 million little devices that display a
 six-digit code computer users must type to gain access to computer
 networks. The code, which changes every minute as determined by an
 RSA-created algorithm, is unique to each "SecureID" token, making it
 useless to a snoop.

 The requirement that users enter the code in addition to a password is
 known as two-factor authentication, an approach that figures to gain ground
 over simple passwords as more and more sensitive data move online.

 Indeed, RSA's sales of authentication products jumped 16 percent last year,
 as RSA's overall profits more than doubled, to $35 million. E-Trade
 Financial Corp. and America Online Inc. began offering SecureID devices to
 some customers over the past year. The Associated Press also uses the
 tokens for network access.

 "It is the Kleenex or Q-Tip of two-factor identification," said Gregg
 Moskowitz, an analyst with the Susquehanna Financial Group. "SecureID is
 the brand name."

 But wide deployment in consumer applications has come slowly.

 In theory, every institution that does business on a Web site could
 increase its security by offering its users RSA tokens.

 But practically, it would be a nightmare to have 20 different devices with
 their own codes. And banks apparently don't trust one another enough to
 accept a competitor's authentication token.


 RSA hopes to smash such hang-ups by acting as an intermediary, launching a
 new "hosted" service this fall in which its servers will check whether a
 consumer entered the proper token code -- even if the token was made by an
 RSA rival -- then relay the "yea" or "nay" back to the bank. RSA already
 provides such a service for companies' internal access control, but has yet
 to offer it for consumer applications.


 Investors will be watching closely. Although Coviello is confident that
 wider trends in access control -- such as rampant identity theft and abuse
 of Social Security numbers -- should play to RSA's strengths, he
 acknowledges that RSA needs to do more to push the market rather than wait
 for it.

 That means RSA has to be much more than the company known for
 authentication tokens -- a product that some analysts say is coming down in
 price because of competition. RSA also hopes to expand its sales of
 software and security consulting services, where heftier rivals such as
 VeriSign Inc. and International Business Machines Corp. also lurk.

 "When you consider all the identity theft that is taking place now, the
 challenge for RSA is to monetize that," Moskowitz said. "It's easier said
 than done."

 RSA believes one key differentiator can be its research arm, including the
 eight people in "RSA Labs," a group so focused on the advanced mathematics
 behind cryptography that it is described as an academic institution within
 the company.

 RSA researchers are expected to dream up ways to expand the use of
 two-factor authentication, though

Re: Fwd: Tor security advisory: DH handshake flaw

[Ben Laurie]

Jerrold Leichter wrote:

| > Isn't *proving* primality rather overkill for the purpose at hand (which
| > seems to be verifying that an alleged prime isn't a non-prime, sent to
| > "spike" the system).  Are there any known sets of numbers - much less ways
| > to *choose* members of those sets - which will show up as prime with
| > significant probability to Miller-Rabin?  As far as I know, M-R has a *worst
| > case* false positive rate of 1/4.  Even a fairly small number of random M-R
| > tests should make slipping in a non-prime less probable than a variety of
| > other attacks.
| 
| There aren't any such sets known to me. Can I be sure there are none known to

| anyone? No.
| 
| Not sure I agree with the false positive rate. What is known is that 3/4 of

| the bases are strong witnesses for a composite number. But is it known that
| these are evenly distributed? I don't know, but that would be required for a
| 1/4 false positive rate.
If you choose random bases, the distribution is irrelevant.  You do trust your 
random number generator, don't you?  :-)


Hmm. This is an excellent point.

--
http://www.apache-ssl.org/ben.html   http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Fwd: Tor security advisory: DH handshake flaw

[Ben Laurie]

Tero Kivinen wrote:

Hal Finney writes:


Several programs to implement ECPP can be found from
http://primes.utm.edu/links/programs/seeking_large_primes/.  I don't
know about source code however.  It might be interesting to run these
over some of the Oakley primes and publish the certs - I vaguely recall
seeing something like that in an RFC.



All the Oakley primes have been proven to be prime, and the
certificates are available at the
ftp://ftp.ssh.com/pub/ietf/ecpp-certificates/. Some of those number
have both ECPP and Primo certificates and the bigger primes have only
Primo certificates (primes bigger than 4096 bits).

When I was writing RFC 3526, I first planned to add those primality
proofs to the document, but as for example the proof of 8192 bit prime
is around 1.3MB, it would have made that document quite boring...

The draft of RFC 3526 used to have url reference to ftp.ssh.com, but
that it was removed by the AD during the IESG evaluation as
"references where are only URL's are problematic".


Hmmm ... better remove all references to RFCs, then! :-)

--
http://www.apache-ssl.org/ben.html   http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

The Devil's Infosec Dictionary

[Udhay Shankar N]

Largely true, sometimes funny.

http://www.csoonline.com/read/080105/debrief.html

Samples:


24/7

adj. The window of time in which systems are most vulnerable to attack
--


Biometrics

Strong authentication mechanism that streamlines insider attacks
--

Cryptography

The science of applying a complex set of mathematical algorithms to 
sensitive data with the aim of making Bruce Schneier exceedingly rich

--

Udhay

--
((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com))


-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]