Re: BofA+Netscape

>Lads,
>
>I thought many of you would be interested in the text of this story. I'm
>wondering if anyone has any comments on the excryption mechanism (i.e.
>"eavesdropping" protection) being used. I believe, from my visits to the
>Netscape (formerly Mosaic) Communications Inc. offices that they are using
>RSA, but I'm not sure how *secure* their implementation is (eg. key size,
>etc.). I'll be contacting my local branch to inquire as to how soon I'll be
>able to use the service and will post my experiences with it as soon as
>possible.

If you check their WWW page, you will find information on the Secure Sockets
Layer.  It explains the algorythm used (RC4) and key size (40 bits).  The
specification is available from a web page off of their site.  With the
latest version of Netscape, you can enable a "secure" connection with their
site.  To do so use:  https://home.mcom.com/   as the home page address.
(You need at least .96 to do this.)

I am not certain as to their key exchange protocol...
|       "Encryption ROT13s your mind."            | alano@teleport.com   |
|"Would you rather be tortured by the government  | Disclaimer:          |
|forces or the people's liberation army?" -mklprc | Ignore the man       |
|   -- PGP 2.6.2 key available on request --      |  behind the keyboard.|

Alan Olsen says:
> If you check their WWW page, you will find information on the Secure Sockets
> Layer.  It explains the algorythm used (RC4) and key size (40 bits).

40 bit RC4 will not stop any attacker with even moderate resources;
its crap.

Also, its not clear we need Yet Another Encryption On Top Of Sockets
protocol.

.pm

In article <199412101803.KAA06370@desiree.teleport.com>, alano@teleport.com (Alan Olsen) wrote:

> If you check their WWW page, you will find information on the Secure Sockets
> Layer.  It explains the algorythm used (RC4) and key size (40 bits).

SSL allows a number of choices for both algorithm and key size.
See http://home.mcom.com/info/SSL.html.

The version of Netscape you can pick up from our FTP server only
implements 40-bit RC4 -- the 40-bit part resulting from standard export
restrictions.  We have implemented and will be shipping clients and
servers with 128-bit RC4 and other configurations.

Cheers,
Marc

-- 
Marc Andreessen
Netscape Communications Corp.
Mountain View, CA
marca@mcom.com

Amanda complained that Netscape pisses all over the
standardization committees.

Well guys, the victor has room to move.  It must come as a big
shock to Apple, Microsoft, and IBM, but reality is that Netscape
can set WWW standards and they cannot.

If they indulge the standardization committees by listening to 
them first, and then deciding to ignore them, the committee
should be thoroughly greatful.

Marc Andreessen:

Hey Mark, you are at netscape.  Please, tell them about
Debug Windows.

Tell them that when debug windows issues a "Fatal Exit" error
message this means that Netscape has trashed internal windows
data, and that Windows may crash at any moment for any reason.

There are no benign "Fatal Exit" warnings.  If it does not
crash your system, it will crash a customers system.

I now have a policy of rebooting after every use of Netscape.

This really bad -- though not as bad as waiting for Mosaic.
to finish slooooowwwwwwwwwly loading some huge document.


-- 
 ---------------------------------------------------------------------
We have the right to defend ourselves and our
property, because of the kind of animals that we        James A. Donald
are.  True law derives from this right, not from
the arbitrary power of the omnipotent state.            jamesd@netcom.com

In article <9412102351.AA09781@snark.imsi.com>, perry@imsi.com wrote:

> 40 bit RC4 will not stop any attacker with even moderate resources;
> its crap.

Agreed -- that's for the export version.  US-only versions of both
the client and the server will use higher key lengths.

Marc

-- 
Marc Andreessen
Netscape Communications Corp.
Mountain View, CA
marca@mcom.com