[117415] in Cypherpunks
You got mail from Wired News
daemon@ATHENA.MIT.EDU (Anonymous)
Thu Sep 2 19:22:02 1999
Date: Thu, 2 Sep 1999 15:57:15 -0700 (PDT)
Message-Id: <199909022257.PAA07829@riviera.hotwired.com>
From: Anonymous <nobody@replay.com>
To: Cypherpunks list <cypherpunks@toad.com>
Reply-To: Anonymous <nobody@replay.com>
Anonymous sent you this message and story from Wired News.
W I R E D N E W S
- - - - - - - - - -
Secure Browsing? Not So Fast
by James Glave
As soon as a new Web service was launched this week promising completely anonymous and private Internet use, along came a renowned crypto expert to punch a huge hole in the claim.
And what was the immediate reaction of the director of technology for PrivacyX, which uses a Web browser's built-in digital certificate technology to offer completely anonymous Web browsing, email, and chat?
"Cool," said Wil Boucher.
See also: Hotmail Accounts Exposed to All
His next reaction was to fix it.
"The hole has been repaired, and will not be a problem," Boucher said within an hour of being alerted to the flaw.
In any event, this wasn't the way PrivacyX CEO Douglas Whorrall had hoped to launch his service after building it up for the last year and a half.
Whorrall promised customers a new level of privacy at an optimum time: the very week of the Hotmail security breach, the most widespread security failure in Web history.
"We have no idea who our customers are," Whorrall said. "We can't show the info to advertisers because we don't know it."
Then Ian Goldberg, chief scientist at Zero-Knowledge Systems, quickly cracked the PrivacyX system.
"It took me and another guy here [at Zero Knowledge] about 20 minutes to figure out how to [break it]," Goldberg said. "Anyone with a Web page on the Net, if PrivacyX visits them, they can tell who they are."
The PrivacyX browser uses a proxy to strip out IP addresses and any other identifying information so, in theory, a user can browse the Web without leaving any identifiable footprints.
The PrivacyX software also filters JavaScript and other scripting languages that can be used to track users.
Until mid-Thursday, though, it failed against Goldberg's hack.
"Click me to go to a site that will show you your real IP address and hostname," Goldberg's
Goldberg also said that his hack could even show the IP address of other PrivacyX users.
Whorrall was immediately notified of the problem and put Boucher on the case.
"As with any software that is put out there for public consumption, we depend on the feedback of others to ensure that we have the best product available at the time," Boucher said. "Any feedback relating to our services can only help us make it better."
Goldberg also said he uncovered problems with the way the PrivacyX proxy uses Secure Sockets Layer -- the crypto that secures Web browsers for e-commerce.
He said that when a user uses the browser to log into a site that already uses SSL, such as Amazon.com, the user loses some of the protection offered by that site's use of the crypto technology.
But PrivacyX's Boucher said that his firm's browser was never intended to be a replacement for trust; rather, it was designed to allow users to visit sites without revealing their identity.
"If you are comfortable enough with a site that you will be performing transactions on that site (which in most cases are going to reveal your identity anyway), you would not need a proxy device to go to that site," Boucher wrote in an email.
In fairness to PrivacyX, Goldberg is one of the world's most esteemed security experts.
In 1995, while a computer science student at the University of California at Berkeley, Goldberg cracked Netscape's SSL implementation.
Three years later Goldberg was part of the team that cloned a GSM cell phone -- a feat the cellular industry had said was impossible.
With the first-week snafu behind him, Whorrall said he hoped his Vancouver-based company will have 1 million subscribers within 18 months, largely because he said PrivacyX offers secure email in addition to private Web browsing.
PrivacyX users can only send secure email to other users of the system.
The company requires members to reconfigure their email client software to send and receive mail through its servers. Customers must then toggle their preferences to switch between email sent and received from PrivacyX, and that handled by their regular ISP.
One competitor remained unimpressed.
Lance Cothrell, president of anonymous Web browsing service Anonymizer.com, said that PrivacyX was jumping on the anonymous browsing bandwagon.
"It always concerns me when people with no background in privacy or security start launching sites like this," said Cothrell.
"I am concerned about their motives and their ability to provide the protection they are promoting."
Whorrall described his team as "young businessmen who have a computer background," and said that they are all long-time advocates of privacy.
Cothrell said that the more consumers understand the value of their privacy, the safer the Web will be for everyone.
"The more people who are doing this, the more the word gets out about this issue, the better."
- - - - - - - - - -
W I R E D N E W S
Wired News is a real-time news service offering news
briefs and in-depth reporting on politics, business, culture,
and technology. For the most up-to-date coverage on the
digital world, go to ...
http://www.wired.com/news/
You are receiving this email because a friend or acquaintance
sent it to you. If you no longer wish to receive these messages,
please contact the sender, and not Wired News.
Copyright 1999 Wired Digital, Inc.
