From: Phil Karn <karn@qualcomm.com>
Date: Mon, 22 Aug 94 20:17:20 PDT
To: smb@research.att.com
Subject: Re: cypherpunks-digest V1 #18
In-Reply-To: <9408191433.AA08423@toad.com>
Message-ID: <199408230317.UAA29137@servo.qualcomm.com>
MIME-Version: 1.0
Content-Type: text/plain


>The purpose of a civilized society is precisely to avoid this sort of
>``arms race'' between bandits and those who pay for services.  Even

This "arms race" would not have been necessary had the vendors and
cellular carriers not been so short sighted as to not put meaningful
cryptographic security into their system at the very beginning. All of
the technology necessary to prevent the now-rampant snooping and
replay of ESNs already existed in the early 1980s when AMPS was being
deployed. It certainly exists now.

Unfortunately, the TIA seems to be just as incompetent now as they
were back then.

The cellular industry is as bad as the credit card industry. Both
claim that cryptographic security mechanisms are not "economically
viable", but if you look more closely you'll discover this conclusion
is based solely on their own direct costs. They ignore the
consequences of bad security borne by others: the mail-order merchant
stuck with a bad debt, the honest customer with a credit rating
destroyed by a stolen card number, the taxpayers who have to pay the
police, courts and prisons to investigate, prosecute and punish credit
card and cellular fraud, and of course every customer who pays a
higher price to subsidize fraud.

As long as the credit card and cellular carriers don't have to carry
these costs themselves, they don't give a damn. And I can't get too
sympathetic when I see them trying to heap even more of the
consequences of their laziness on the legal system.

Phil