Re: SSL weakness affecting links from pa

--Boundary..3953.1071713693.multipart/signed
Content-Type: text/plain
Content-Transfer-Encoding: 7bit


As the person who invented (and mispelt) the referer link I don't
agree
with the arguments made against it. The purpose of the referer link is
to allow servers to collate pages of backlinks. This would make the
Web browsable in both directions.

I could never understand why Netscape supported the facility in the 
browser without also supporting the capture functionality in the
server. Its a simple matter to add support but they seem uninterested.

Of course there should be a toggle to allow users to turn off the 
referer field. I tried to get a recomendation to do this put into the
spec. People then started shouting at me saying that it was impossible
to enforce and so the recomendation shouldn't be there. Quite
what the relevance of 'encforcement' is I don't know.


Then they started jamming stupid ideas like cookies into the spec,
ideas that showed all of five minutes thought.


 
>Which was my original point. I'd even be willing to *pay* for a cert,
but
>not more than about $15. I just find it odd that I can get SSL server
>software for cheaper than I can get a license to operate said
software.
>Hey Verisign, why don't you offer a Class 1 server certificate?

The manner in which SSL is designed means that it requires a degree
of trust in the certificate. Allowing the browser to automatically
accept
a class 1 cert would be somewhat foolhardy. Because someone put
that damn key on the bottom of the browser some people expect there
to be security. Instead they get encryption which ain'tquite the same 
thing.

There is nothing to stop you using a non standard cert with SSL
however.
I use Apache with a cert I wrote myself.

    Phill




--Boundary..3953.1071713693.multipart/signed
Content-Type: application/octet-stream; name="bin00002.bin"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="bin00002.bin"
Content-Description: "smime.p7s"

MIIGVAYJKoZIhvcNAQcCoIIGRTCCBkECAQExCzAJBgUrDgMCGgUAMAsGCSqG
SIb3DQEHAaCCBUMwggU/MIIEqKADAgECAhBhQxVohIHU1aLeK14myavFMA0G
CSqGSIb3DQEBBAUAMGIxETAPBgNVBAcTCEludGVybmV0MRcwFQYDVQQKEw5W
ZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNpZ24gQ2xhc3MgMSBDQSAt
IEluZGl2aWR1YWwgU3Vic2NyaWJlcjAeFw05NzA0MTAwMDAwMDBaFw05ODA0
MTAyMzU5NTlaMIIBGzERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZl
cmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0g
SW5kaXZpZHVhbCBTdWJzY3JpYmVyMUYwRAYDVQQLEz13d3cudmVyaXNpZ24u
Y29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUmVmLixMSUFCLkxURChj
KTk2MScwJQYDVQQLEx5EaWdpdGFsIElEIENsYXNzIDEgLSBNaWNyb3NvZnQx
JDAiBgNVBAMTG1BoaWxsaXAgTWFydGluIEhhbGxhbS1CYWtlcjEgMB4GCSqG
SIb3DQEJARYRaGFsbGFtQGFpLm1pdC5lZHUwXDANBgkqhkiG9w0BAQEFAANL
ADBIAkEAn1xytd7KYvG9xC2rzkxgAmoQLavzeX5JhSRifuyeS0Ib8m4juKZA
+SM6K+C8PAt+nfRu2/QtDFlS6KRs/ty8rQIDAQABo4ICfTCCAnkwCQYDVR0T
BAIwADCCAh8GA1UdAwSCAhYwggISMIICDjCCAgoGC2CGSAGG+EUBBwEBMIIB
+RaCAadUaGlzIGNlcnRpZmljYXRlIGluY29ycG9yYXRlcyBieSByZWZlcmVu
Y2UsIGFuZCBpdHMgdXNlIGlzIHN0cmljdGx5IHN1YmplY3QgdG8sIHRoZSBW
ZXJpU2lnbiBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVudCAoQ1BT
KSwgYXZhaWxhYmxlIGF0OiBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vQ1BT
OyBieSBFLW1haWwgYXQgQ1BTLXJlcXVlc3RzQHZlcmlzaWduLmNvbTsgb3Ig
YnkgbWFpbCBhdCBWZXJpU2lnbiwgSW5jLiwgMjU5MyBDb2FzdCBBdmUuLCBN
b3VudGFpbiBWaWV3LCBDQSA5NDA0MyBVU0EgVGVsLiArMSAoNDE1KSA5NjEt
ODgzMCBDb3B5cmlnaHQgKGMpIDE5OTYgVmVyaVNpZ24sIEluYy4gIEFsbCBS
aWdodHMgUmVzZXJ2ZWQuIENFUlRBSU4gV0FSUkFOVElFUyBESVNDTEFJTUVE
IGFuZCBMSUFCSUxJVFkgTElNSVRFRC6gDgYMYIZIAYb4RQEHAQEBoQ4GDGCG
SAGG+EUBBwEBAjAsMCoWKGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9yZXBv
c2l0b3J5L0NQUyAwEQYJYIZIAYb4QgEBBAQDAgeAMDYGCWCGSAGG+EIBCAQp
FidodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9DUFMwDQYJ
KoZIhvcNAQEEBQADgYEAJh3+fz9jUp3TQecpDPMYoZLUJ42ncGftpS00xNE8
ILttcpp9CPSB38TMpr0JIyetRoMCB6M4Sq5IrNadWE/Ot5Rj//x8GjP5f2UW
jZnenvCgSGbZdy0d0j+9jk9O+sDZ2f7fKCMYabUDVatyJfIhLVlxuXChUKdi
CiEiUEjOtnUxgdowgdcCAQEwdjBiMREwDwYDVQQHEwhJbnRlcm5ldDEXMBUG
A1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNz
IDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXICEGFDFWiEgdTVot4rXibJ
q8UwCQYFKw4DAhoFADANBgkqhkiG9w0BAQEFAARAQmqA2pordFdnUCnmwwPj
SIdO2oV2PAMP7Tyausy8lQ225rFtz2ScGb5ELn9IocyhaJZvnLX1c71Jkd43
tI9Pyw==
--Boundary..3953.1071713693.multipart/signed--

"Phillip M. Hallam-Baker" <hallam@ai.mit.edu> writes:
> As the person who invented (and mispelt) the referer link I don't
(binary nonsense snipped)

$1 to Sinn Fein - thank you.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

At 05:05 PM 4/18/97 -0400, Phillip M. Hallam-Baker wrote:
>As the person who invented (and mispelt) the referer link I don't
>agree with the arguments made against it. 
>The purpose of the referer link is
>to allow servers to collate pages of backlinks.
>This would make the Web browsable in both directions.
...
>Then they started jamming stupid ideas like cookies into the spec,
>ideas that showed all of five minutes thought.

One major problem with these features is that the security
implications become far more complex when you start combining them.
For instance, autoloading images without referer are safe - but
images + referer gives enough information to run doubleclick.
Cookies without referer are pretty safe - but cookies+referer
make cookies far less safe, and doubleclick more effective.

Then you start putting HTML capability in news readers,
and anybody who reads an article with an IMG in it
creates a record for spammers (or Arbitron) to use.

Rich Graves said that if you don't like the feature, take it up with the 
folks who wrote the spec - but the RFCs say that Referer needs to
be handled carefully, and should be optional...

>Of course there should be a toggle to allow users to turn off the 
>referer field. I tried to get a recomendation to do this put into the
>spec. People then started shouting at me saying that it was impossible
>to enforce and so the recomendation shouldn't be there. 

Perhaps too much commercial advertising capability already depended on it?


#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#     (If this is a mailing list, please Cc: me on replies.  Thanks.)

I'm suprosed no one has suggested paying people for
advertising.  If the Netscape folks would integrate digicash into
Communicator, then I could program my browser to only send referer to
sites that paid for the information, and rent cookie space.  Want your
cookie to live till 1999?  Thats 24 months, at 50 cents per month...do
you want to pay?

	These tools would allow users to set a value on their privacy,
and get the money from advertisers.  I know nothing encourages me to
buy a product like getting cold hard cash from the maker.

Adam

Bill Stewart wrote:

| >Of course there should be a toggle to allow users to turn off the 
| >referer field. I tried to get a recomendation to do this put into the
| >spec. People then started shouting at me saying that it was impossible
| >to enforce and so the recomendation shouldn't be there. 
| 
| Perhaps too much commercial advertising capability already depended on it?



-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

> If the Netscape folks would integrate digicash into Communicator,
> then I could program my browser to only send referer to sites that
> paid for the information, and rent cookie space.  Want your cookie to
> live till 1999?  Thats 24 months, at 50 cents per month...do you want
> to pay?

That would only work until someone abuses it. People could create web
robots to run around selling referers and several gigabytes of
worthless cookie space. Worthless, because nobody cares about the web
browsing habits of J. Random Robot, and they certainly don't want to
blow $50 e-bucks on the bot's repeated visits.

At 03:32 PM 4/20/97 -0500, Adam Shostack wrote:
>	Thats true, but can they avoid it?  I'm considering writing a
>database pollution bot, which runs around, claiming to be Mozilla or
>IE, and randomly following a link once per minute.  Why?  Database
>pollution.  If there are a few thousand of these randomly collecing
>links and creating arbitrary (or perhaps biased) viewing habbits in
>the databases of the advertisers, then their individual data becomes
>worth less.  They'll need to actively solicit peoples permission to
>collect data before doing so, to avoid people polluting their
>databases.
>
>	Similarly, putting a randomly generated email address in those
>sign up fields produces pollution in the data used by spammers, which
>costs them (and no one else) money.  If you run your own site, you can
>even bit bucket the email, trading their bandwidth for yours, and
>making them think they're delivering more junk email than they are.

You are forgetting to separate the marketers from the businesses being
marketed here.  While they're occasionally one and the same (see Cantor &
Siegel), in today's world, the marketing is being handled by a third party
(doubleclick).

These marketers get paid by hit-count ratings:  if they deliver the message
to 1,000 browsers, they get some amount, say $15.00.  If they deliver it to
100,000 browsers, they get $1500.00.  They're not paid by the number of
respondents, referred sales, or even valid e-mail addresses snarfed.  So,
you'd only be artifically inflating the cost of the marketers to the
advertisers.

Here, your hope is that the advertisers notice a diminishing ROI for
marketing costs, but that's a big hope.  The numbers for a small site might
look something like this:

January -  20,000 hits, 50 sales
February - 22,000 hits, 60 sales
March    - 25,000 hits, 70 sales
April    - 50,000 hits, 90 sales  <-- pollutionbot strikes 20,000 times

So, you've watered it down a bit.  To make the pollutionbot truly
effective, you'd have to hit a site by at least 10x the general population
strikes:

May      - 440,000 hits, 100 respondents <- pollutionbot strikes 400,000 times

In the meantime, they're billing the business:
Month        Hits   Sales  Billing    Cost/sale  Pollutionbot hits/inflation
January  -  20,000   50     $300        $6.00            0     $0
February -  22,000   60     $330        $5.50            0     $0
March    -  25,000   70     $375        $5.36            0     $0
April    -  50,000   90     $750        $8.33       20,000   $300
May      - 440,000  100    $6600       $66.00      400,000  $6000

Hopefully, the advertisers will pull out at this point.  It's easy to see
that something "bad" is happening, and that they're not getting the bang
for the buck that they need.  However, with some megasites (where they
reportedly get 2,000,000+ hits per day) subscribing to doubleclick.com,
it's doubtful you could make a noticable dent unless you started your
attack from a T3 connected backbone site.  And even then, are you sure you
want to spend your resources this way?

The marketers will also try to keep this sham up by saying to the
businesses, "It's the Internet, who the hell knows?  Keep going another
month, it'll get better.  In the meantime, just pay your bills."

Even if you were successful at flooding doubleclick, many of their
advertisers are Big:  IBM, Micro$oft, HP, etc.  They don't even care about
direct responses, they're just after name recognition.

Ultimately, it'll reduce the ability of Mom & Pop (or Cantor & Siegel) to
advertise on the same playing field as Micro$oft.  Doubleclick won't go
broke; neither will Micro$oft.  The only good hope you may have is of
breaking a "mom & pop" version of doubleclick, and keeping the world less
polluted.  But, doubleclick will still be around and be able to move in and
fill the void.  What have you gained then?

John
--
J. Deters "Don't think of Windows programs as spaghetti code.  Think
          of them as 'Long sticky pasta objects in OLE sauce'."
+--------------------------------------------------------------------+
| NET:   mailto:jad@dsddhc.com (work)   mailto:jad@pclink.com (home) |
| PSTN:  1 612 375 3116 (work)          1 612 894 8507 (home)        |
| ICBM:  44^58'36"N by 93^16'27"W Elev. ~=290m (work)                |
| For my public key, send mail with the exact subject line of:       |
| Subject: get pgp key                                               |
+--------------------------------------------------------------------+

Steve wrote:
| > If the Netscape folks would integrate digicash into Communicator,
| > then I could program my browser to only send referer to sites that
| > paid for the information, and rent cookie space.  Want your cookie to
| > live till 1999?  Thats 24 months, at 50 cents per month...do you want
| > to pay?

| That would only work until someone abuses it. People could create web
| robots to run around selling referers and several gigabytes of
| worthless cookie space. Worthless, because nobody cares about the web
| browsing habits of J. Random Robot, and they certainly don't want to
| blow $50 e-bucks on the bot's repeated visits.

	Thats true, but can they avoid it?  I'm considering writing a
database pollution bot, which runs around, claiming to be Mozilla or
IE, and randomly following a link once per minute.  Why?  Database
pollution.  If there are a few thousand of these randomly collecing
links and creating arbitrary (or perhaps biased) viewing habbits in
the databases of the advertisers, then their individual data becomes
worth less.  They'll need to actively solicit peoples permission to
collect data before doing so, to avoid people polluting their
databases.

	Similarly, putting a randomly generated email address in those
sign up fields produces pollution in the data used by spammers, which
costs them (and no one else) money.  If you run your own site, you can
even bit bucket the email, trading their bandwidth for yours, and
making them think they're delivering more junk email than they are.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Adam Shostack writes:
> 
> 	Thats true, but can they avoid it?  I'm considering writing a
> database pollution bot, which runs around, claiming to be Mozilla or
> IE, and randomly following a link once per minute.  Why?  Database
> pollution.  If there are a few thousand of these randomly collecing
> links and creating arbitrary (or perhaps biased) viewing habbits in
> the databases of the advertisers, then their individual data becomes
> worth less.  They'll need to actively solicit peoples permission to
> collect data before doing so, to avoid people polluting their
> databases.

That's an interesting thought.
As it happens last week I added a way in Cookie Jar to allow sending HTTP
User-agent to some sites... the reason is that I ran into a couple that
absolutely have to know what type of browser you are using, and if given no
User-agent deliver either meaningless HTML or nothing at all.
Well Fargo and wIrEd.cOm are the ones I found.

So I added a rule to pass the User-agent line to sites like that.
However I edit out the part that informs the server what OS etc
you are running.  The User-agent is usually something of the form

User-Agent: Mozilla/3.0Gold (X11; U; Linux 6.6.6 i386)

and it's the part in the parens that I really object to, the part
that says what browser you have seems to be what the sites in question
need to deliver useable HTML.

I briefly had it send:

User-Agent: Mozilla/3.0Gold (why; they; fuck do you care)

but now it sends nothing at all in the parens.


In order to maximally fuck up stats, what should be put into
the windowing system/OS fields?  It has to be something that
exists and is fairly common, so that its not able to be thrown out
by the stats-gathers.  I could use "(X11; MVS; IBM MVS some version number)"
but that'd be easy to throw out, even though ports of X to MVS really did
exist.

Maybe I'll just make every copy of Cookie Jar look like
it's running on Linux.


BTW, Wells Fargo's on-line banking sucks dead gerbils through a dirty
garden hose.  The interface is poor, it checks that you're using
SSL not by actually trying it, but by checking the User-agent
field to see if you're using a browser that supports SSL, and
then when I try to transfer money between accounts, it refuses with
no explanation.  A fine example of how NOT to do things.


-- 
   Eric Murray  ericm@lne.com         Privacy through technology!
  Network security and encryption consulting.    PGP keyid:E03F65E5

Eric Murray wrote:


| User-Agent: Mozilla/3.0Gold (X11; U; Linux 6.6.6 i386)

| In order to maximally fuck up stats, what should be put into
| the windowing system/OS fields?  It has to be something that
| exists and is fairly common, so that its not able to be thrown out
| by the stats-gathers.  I could use "(X11; MVS; IBM MVS some version number)"
| but that'd be easy to throw out, even though ports of X to MVS really did
| exist.
|
| Maybe I'll just make every copy of Cookie Jar look like
| it's running on Linux.

	I think you should rotate through a list, in case they're
keeping track of it in conjunction with your other information.  Thus,
have the same cookies comeing from different user agents, say rotate
between Rhapsody on PowerPC and Linux on an Alpha.

	Alternately, have it come from Internet Exploder on various
UNIX boxes.  (Unless thats now generally available.)

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Eric Murray <ericm@lne.com> writes:
> Maybe I'll just make every copy of Cookie Jar look like
> it's running on Linux.

On an i386. Fight bloatware, influence markets, win friends!

Jer

(No PGP sig `cuase I'm running an unencrypted connection)
(Yeah, I store my private key on a multi-user machine, so sue me.)

"standing on top of the world/ never knew how you never could/ never knew
 why you never could live/ innocent life that everyone did" -Wormhole

At 09:34 19/04/97 -0500, Adam Shostack wrote:
>
>	I'm suprosed no one has suggested paying people for
>advertising.  

This is one of the more novel ideas that Digital have come up with for
Millicent. 

In return for allowing the advertiser to download their advert to you, you
get credited with an amount of scrip which is redeemable at their site. 

An interesting concept...

Rachel
Rachel Willmer
<rachel@intertrader.com>
Intertrader Ltd
<http://www.intertrader.com>
4 John's Place                                                       Tel:
+44 131 555 8450
Edinburgh EH6 7EL                                             Fax: +44 131
555 8451          

Authors of "Digital Money Online" (TM)
<http://www.intertrader.com/library/DigitalMoneyOnline/>

Rachel Willmer wrote:
| At 09:34 19/04/97 -0500, Adam Shostack wrote:
| >	I'm suprosed no one has suggested paying people for
| >advertising.  
| 
| This is one of the more novel ideas that Digital have come up with for
| Millicent. 
| 
| In return for allowing the advertiser to download their advert to you, you
| get credited with an amount of scrip which is redeemable at their site. 

	At their site?  Feh.  Thats a coupon, not money.

	I was cash.  Cold, hard cash that I can spend on nifty toys.
Otherwise, what good do all those Microsoft cookies do me?  I accept
your cookie, I get paid for it.  If I don't buy your product, then,
heck, get yourself better advertising, or a better product.



Adam
-- 
	"Cash value 1/20th of a cent."