Bank information protected by 40-bit encryption....

If you are the worring sort (or are looking for a ripe target)
point your browser at:
    https://www.diginsite.com/clients.html

There is a list of 23 Credit Unions - some (or all) of which
allow transactions to be done over the net.

A brief once over shows that it requires Netscape 2.0 or 
better so you will have encryption, but it does not warn you 
when you are using only a 40-bit session key vs. a 128-bit key.
(Netscape wizards - is there a way that the server can detect
 this so that a warning message could be put up?)

They also have some other information about their security at:
   http://www.diginsite.com/security/security.html

I think it is GREAT that this kind of functionality is coming.
I also think that the pioneers like this had better be prepared
to be targets as I am sure they will be.

Dan

------------------------------------------------------------------
Dan Oelke                                  Alcatel Network Systems
droelke@aud.alcatel.com                             Richardson, TX

Daniel R. Oelke wrote:
> A brief once over shows that it requires Netscape 2.0 or
> better so you will have encryption, but it does not warn you
> when you are using only a 40-bit session key vs. a 128-bit key.
> (Netscape wizards - is there a way that the server can detect
>  this so that a warning message could be put up?)

  There is an environment variable called HTTPS_KEYSIZE that
is passed to cgi's by the HTTP server.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

>   There is an environment variable called HTTPS_KEYSIZE that
> is passed to cgi's by the HTTP server.

	HTTPS_SECRETKEYSIZE is the one you need to watch.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer@c2.net

Daniel R. Oelke writes:
> If you are the worring sort (or are looking for a ripe target)
> point your browser at:
>     https://www.diginsite.com/clients.html
> 
> There is a list of 23 Credit Unions - some (or all) of which
> allow transactions to be done over the net.
> 
> A brief once over shows that it requires Netscape 2.0 or 
> better so you will have encryption, but it does not warn you 
> when you are using only a 40-bit session key vs. a 128-bit key.
> (Netscape wizards - is there a way that the server can detect
>  this so that a warning message could be put up?)

Yes.  Netscape servers pass three (additional) environment variables to
CGI programs when used with SSL.  For a 40-bit invocation, you get:

    HTTPS=ON
    HTTPS_KEYSIZE=128
    HTTPS_SECRETKEYSIZE=40

So, you can distinguish 40- versus 128-bit usage.


-- Jeff

Daniel R. Oelke wrote:
> 
> If you are the worring sort (or are looking for a ripe target)
> point your browser at:
>     https://www.diginsite.com/clients.html
> 
> There is a list of 23 Credit Unions - some (or all) of which
> allow transactions to be done over the net.
> 
> A brief once over shows that it requires Netscape 2.0 or
> better so you will have encryption, but it does not warn you
> when you are using only a 40-bit session key vs. a 128-bit key.
> (Netscape wizards - is there a way that the server can detect
>  this so that a warning message could be put up?)

For Netscape servers, you can configure which ciphers you want to use.
I'm sure Apache-SSL and most other SSL-capable servers have the same
sort of thing.  I know that Wells Fargo, at least, requires 128-bit
encryption.

-- 
Sure we spend a lot of money, but that doesn't mean | Tom Weinstein
we *do* anything.  --  Washington DC motto          | tomw@netscape.com

> For Netscape servers, you can configure which ciphers you want to use.
> I'm sure Apache-SSL and most other SSL-capable servers have the same
> sort of thing.  I know that Wells Fargo, at least, requires 128-bit
> encryption.

	(Yeah, Apache-SSL lets you do that too)

	Uh, but Wells Fargo doesn't. Just the other day I used
Netscape 1.x international (i.e. 8cent RC4) to get my bank balances
from Wells Fargo.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer@c2.net

sameer@c2.org wrote:
> 
> > For Netscape servers, you can configure which ciphers you want to
> > use. I'm sure Apache-SSL and most other SSL-capable servers have
> > the same sort of thing.  I know that Wells Fargo, at least,
> > requires 128-bit encryption.
> 
>         (Yeah, Apache-SSL lets you do that too)
> 
>         Uh, but Wells Fargo doesn't. Just the other day I used
> Netscape 1.x international (i.e. 8cent RC4) to get my bank balances
> from Wells Fargo.

Can you transfer money or just check balances?  I'm pretty sure that
they won't let you perform transactions unless you're using
Netscape 2.0 with 128-bit encryption.

-- 
Sure we spend a lot of money, but that doesn't mean | Tom Weinstein
we *do* anything.  --  Washington DC motto          | tomw@netscape.com

> 
> Can you transfer money or just check balances?  I'm pretty sure that
> they won't let you perform transactions unless you're using
> Netscape 2.0 with 128-bit encryption.

	I was unaware the Wells Fargo let you transfer money with the
web. I only checked my balance.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer@c2.net

sameer@c2.org wrote:
> 
> > Can you transfer money or just check balances?  I'm pretty sure that
> > they won't let you perform transactions unless you're using
> > Netscape 2.0 with 128-bit encryption.
> 
>         I was unaware the Wells Fargo let you transfer money with the
> web. I only checked my balance.

Sorry, I think I was hallucinating or something.  You're right, they
don't require 128-bit encryption and they only let you query your
balance.

-- 
Sure we spend a lot of money, but that doesn't mean | Tom Weinstein
we *do* anything.  --  Washington DC motto          | tomw@netscape.com

On Wed, 10 Apr 1996, Tom Weinstein wrote:

> Sorry, I think I was hallucinating or something.  You're right, they
> don't require 128-bit encryption and they only let you query your
> balance.

Are there any banks besides SFNB then that use weak 40-bit encryption for
anything more than balance queries or transaction history, and allow to
make real transactions on-line?

I know Merita in Finland allows bank transactions using 40-bit RC4, but
they also use one-time passwords (every user gets a printed list with 40
or so password pairs, each of which you can use just once).

Juri Kaljundi
jk@digit.ee

On Thu, 11 Apr 1996, =?ISO-8859-1?Q?J=FCri_Kaljundi?= wrote:

> On Wed, 10 Apr 1996, Tom Weinstein wrote:
> 
> > Sorry, I think I was hallucinating or something.  You're right, they
> > don't require 128-bit encryption and they only let you query your
> > balance.
> 
> Are there any banks besides SFNB then that use weak 40-bit encryption for
> anything more than balance queries or transaction history, and allow to
> make real transactions on-line?

http://www.eub.com

> 
> I know Merita in Finland allows bank transactions using 40-bit RC4, but
> they also use one-time passwords (every user gets a printed list with 40
> or so password pairs, each of which you can use just once).
> 
> Juri Kaljundi
> jk@digit.ee
> 
> 

---
My preferred and soon to be permanent e-mail address:unicorn@schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information

Tom Weinstein wrote:
> For Netscape servers, you can configure which ciphers you want to use.
> I'm sure Apache-SSL and most other SSL-capable servers have the same
> sort of thing.  I know that Wells Fargo, at least, requires 128-bit
> encryption.

  Actually I don't think that Wells Fargo requires 128-bit.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.