From: Tim Scanlon <tfs@vampire.science.gmu.edu>
Date: Tue, 26 Sep 95 08:09:51 PDT
To: cypherpunks@toad.com
Subject: Insecurity in WWW oriented security
Message-ID: <9509261509.AA10554@vampire.science.gmu.edu>
MIME-Version: 1.0
Content-Type: text/plain



I wanted to share an experience with folks on the list
that points to the relavince of what c'punks have been
doing looking at the Web encryption & security issues
like we have.

I was approached by a headhunter yesterday who wanted me
to do the security for a hospital connected to the net.
Straightforward stuff one would think. My inital reaction
was fairly positive, and I responded that I didn't think
I would have much trouble with the task as long as they had
a resonable setup internaly etc. etc. (I'm not a big beliver
in hard & crunchy -> soft & chewey when your accounting or
other critical data is part of what can be chewed up...)

Well at that point it got interesting. He told me that said
client was asking as a part of their requirments that they
be able to do "Secure transactions using HTML & Netscape".
My reaction was somwehere allong the lines of "What do they
mean by `secure transactions'!! Are they aware that the state of
encryption for WWW is really poor at best right now? I told him
that I thought this might not be such a hot idea, and that
my interest in this whole thing would hinge totaly upon exactly
what sorts of transactions they wanted to do using web servers
and the like. And that depending on the answer to that, I would
or would not be intrested in the whole thing.

The reason for my hesitation? I don't want blood on my hands over
a setup that is by definition currently in a state of very poor
security. And right now I have no idea if they want to transfer
MasterCard's or MRI's. But I do know that depending on what it
is they're planning, it might not be a place *I* want to be.

Besides being damned frightening, this points to a trend in
network evolution. Organizations are planning these sorts of
moves and utilizations of the technology with little thought
to the possible consequences of it.

And if the FBI ends up busting some psyco in the future for
tampering with the transactions of MRI data, x-rays, or any
of a million other possibilities, I seriously doubt that
Loius Freeh will be stepping forward to remind us all of
the need for robust security. Instead, it is far more likely
that he would argue that it was another example of the need
for increased monitoring of the internet and controls on
cryptographic solutions.

I found aspects of the whole conversation, juxtaposed with
what has been going on lately with the list chilling to
say the least.



Tim Scanlon


________________________________________________________________
tfs@vampire.science.gmu.edu (NeXTmail, MIME)  Tim Scanlon
George Mason University     (PGP key avail.)  Public Affairs
I speak for myself, but often claim demonic possession