Re: the return of key escrow?
On Thu, Feb 16, 2006 at 06:54:21PM +1300, Peter Gutmann wrote: Steven M. Bellovin [EMAIL PROTECTED] writes: According to the BBC, the British government is talking to Microsoft about putting in a back door for the file encryption mechanisms. That's one way of looking at it. It's not really a backdoor, it's a way of spiking DRM. This is exactly it. For years Western governments have been worried that terrorists might build a secure distribution network for information and orders, and now Hollywood is building one. A fake record label would be a fantastic front for such a thing; each subscriber device (such as a PC or mobile phone) can be uniquely identified, so when your agent downloads the latest hit single he actually gets four minutes of orders etc; nobody can tell from the outside, it's wiretap-resistant, the agent can't have the key beaten out of him because he doesn't know it, it's difficult and time-consuming to extract it from the device, and because everyone has one it's quite hard to use traffic analysis alone to pick out suspects. There is no way Microsoft is going to build in a back door to Vista for Special Branch - once they do that for one government and it becomes known all hell breaks loose and they get banned from half their markets. Some form of crazy overcomplicated key escrow system might happen; might as well tie people's TCPA keys to their biometric identity cards, right? Pete -- Peter Clay | Campaign for _ _| .__ | Digital / / | | | Rights! \_ \_| | | http://www.ukcdr.org - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: [Clips] Banks Seek Better Online-Security Tools
On Mon, Dec 05, 2005 at 07:29:11PM +0100, Florian Weimer wrote: For those of you who haven't rolled out a national ID scheme in time, there's still the general identity theft problem, but this affects you even if you don't use online banking. Hmm. What's the evidence that national ID schemes reduce credit fraud (what people normally mean when they say ID theft)? How does it vary with the different types of scheme? I've been opposing the UK scheme recently on the grounds of unreliable biometrics and the bad idea of putting everyone's information in a basket from which it can be stolen (in addition to the civil liberties reasons). My solution to the credit fraud problem is simple: raise the burden of proof for negative credit reports and pursuing people for money. Pete -- Peter Clay | Campaign for _ _| .__ | Digital / / | | | Rights! \_ \_| | | http://www.ukcdr.org - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: Hooking nym to wikipedia
I'm a bit concerned by this scheme. I'm not clear at the moment whether you're proposing imposing it on all wikipedia users or just those that want to access via Tor? On Mon, Oct 03, 2005 at 11:48:48AM +, Jason Holt wrote: * Lack of forward secrecy is indeed an issue, since our metaphorical Chinese dissident must keep around her cert to continue using it, which if discovered links her with all her past activities. This is a problem even if Wikipedia maps each client cert to a particular random value for public display, since the attackers can simply use the stolen cert to make an edit on wikipedia and then check to see if the identifier comes up the same. There's a big useability issue with client certs, in that they are part of a particular PC browser profile and are fiddly to move between PCs; while being moved (e.g. USB key) or at rest on the disk they are vulnerable to raids by the security services. I'd expect the mythical Chinese dissident to be using netcafes rather than his/her home PC which will have a keylogger installed on it / be taken as evidence in raids. (e.g. http://gizmonaut.net/bits/suspect.html ) (Also, I'd expect any serious repressive regimes to simply have anyone found using Tor taken out and shot; has this been addressed?) Pete -- Peter Clay | Campaign for _ _| .__ | Digital / / | | | Rights! \_ \_| | | http://www.ukcdr.org - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: A National ID
On Mon, 31 May 2004, R. A. Hettinga wrote: in most European countries, people carry national ID's as a matter of course. And pressure is mounting in America for some kind of security card. Similarly, there is a push for ID cards in the UK at the moment. See http://www.stand.org.uk/ and http://www.no2id.net/ for more detail. No doubt the same arguments for and against apply on both sides of the Atlantic, and it would be good if activists were to share information. Note that the real danger is not the cards but the database for which they are a unique key. See just about every issue of RISKS for ways in which big national databases can go wrong. Pete -- Peter Clay | Campaign for _ _| .__ | Digital / / | | | Rights! \_ \_| | | http://www.ukcdr.org - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
RE: Open Source (was Simple SSL/TLS - Some Questions)
On Thu, 9 Oct 2003, Peter Gutmann wrote: I would add to this the observation that rather than writing yet another SSL library to join the eight hundred or so already out there, it might be more useful to create a user-friendly management interface to IPsec implementations to join the zero or so already out there. The difficulty in setting up any IPsec tunnel is what's been motivating the creation of (often insecure) non- IPsec VPN software, so what'd be a lot more helpful than (no offense, but) yet another SSL implementation is some means of making IPsec easier to use (although that may not be possible... OK, let's say less painful to use :-). Having spent much of the past few weeks trying to sort out a workable VPN solution, I think this is a good but doomed idea. http://vpn.ebootis.de/ has the best free windows IPsec configuration tool I've found, but that doesn't help. Why? Because IPsec traffic is not TCP traffic and therefore gets dropped by random networks. If you want a VPN that road warriors can use, you have to do it with IP-over-TCP. Nothing else survives NAT and agressive firewalling, not even Microsoft PPTP. If someone out there wants to write VPN software that becomes widely used, then they should make a free IP-over-TCP solution that works on Windows and Linux which uses password authentication. Pete -- Peter Clay | Campaign for _ _| .__ | Digital / / | | | Rights! \_ \_| | | http://www.ukcdr.org - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
