RE: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)

no doubt all the responses to the cypherpunk list are unnecessary as we all
agree this is a load of PR nonsense. But I just can't believe that he thinks 
that
the telephone is more secure on average than a keyboard.  I can tell pretty 
easily
if something is running on my system that I didn't intend..it is much less 
probably to say that I know that someone isn't listening with a scanner if 
I'm on
a cordless or just plain tapping my line if I'm on a standard phone. 
 Admittedly I
think cell phones may take more effort on the part of the eavesdropper but 
are
still doable.

I'm certain that none of first virtual customers use a cordless phone, 
indeed 
since you feel the telephone is such a secure device you no doubt require
that all of your customers use STUIII phones to communicate. 


----------
From: 	Nathaniel Borenstein[SMTP:nsb@nsb.fv.com]
Sent: 	Monday, January 29, 1996 12:07 PM
To: 	cypherpunks@toad.com
Subject: 	FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards


First Virtual's Internet Payment Systems never places the consumer's
credit card number on the Internet.  Instead, the consumer provides it
      to us by telephone when the account is opened.  
----------
From: 	Nathaniel Borenstein[SMTP:nsb@nsb.fv.com]
Sent: 	Monday, January 29, 1996 1:39 PM
To: 	cypherpunks@toad.com; dmacfarlane@zip.sbi.com
Subject: 	Re: FV's Borenstein discovers keystroke capture programs! 
(pictures at 11!)

Well, the mis-conceptions are flying fast and furious.

You're twisting our words.  We believe it is a truly fatal flaw in those
internet commerce schemes that are based on software encryption of
credit card numbers.  There are several schemes for Internet commerce
that are unaffected:

	-- First Virtual (of course)

Nathaniel Borenstein wrote:

> We have a few pages of C code that scan everything you type on a
> keyboard, and selects only the credit card numbers.  How easy is that to
> do with credit card numbers spoken over a telephone?
> 
> The key is large-scale automated attacks, not one-time interceptions.

This fact that the filtering can be done on the client side is nearly 
irrelevant. Most people do not hit enough keystrokes in a day to prevent sending 
the entire keyboard stream back to the filtering agent.

Since most folks do not spend most of their time typing in nonsense phrase, you 
could probably pick out the First Virtual account number also. With only a 
little more cleverness you can get the file containing private keys. With a few 
thousand tries through the stream you can decrypt that file using the user's 
pass phrase.

If you have the ability to change the software on the user's machine to 
something arbitrary, why bother stopping at something as "trivial" as a single 
credit card number.

PK
--
Philip L. Karlton			karlton@netscape.com
Principal Curmudgeon			http://www.netscape.com/people/karlton
Netscape Communications Corporation

>  But I just can't believe that he thinks that
the telephone is more secure on average than a keyboard.

We have a few pages of C code that scan everything you type on a
keyboard, and selects only the credit card numbers.  How easy is that to
do with credit card numbers spoken over a telephone?

The key is large-scale automated attacks, not one-time interceptions.
--------
Nathaniel Borenstein <nsb@fv.com>
Chief Scientist, First Virtual Holdings
FAQ & PGP key: nsb+faq@nsb.fv.com

Nathaniel Borenstein wrote:

| >  But I just can't believe that he thinks that
| the telephone is more secure on average than a keyboard.
| 
| We have a few pages of C code that scan everything you type on a
| keyboard, and selects only the credit card numbers.  How easy is that to
| do with credit card numbers spoken over a telephone?

I don't speak my credit card number into the FV line, I DTMF it.
Whats more, I do so after the interactive voice system says the words
'credit card.'  In fact, a group of people may have been running a tap
& scan on FV's line for a long time now, using each number they steal
once.

	Credit cards are crappy financial instruments, made useful
mainly by the governments limitations of liability rules.  Why defend
them?

	FV's attack is pretty bogus, but no more bogus, and possibly
less, than the Power One Time Pads.  We're going to see a lot of smoke
and mirrors in the next few years regarding security.

	Anyone have anything to say about RC2?  Someone must have
written a main() for it?

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume