Earlier quoted context omitted.
Canadian constitutional law has something called the 'living tree doctrine', which states that the constitution can grow and evolve over time, being reinterpreted in new contexts. To push the metaphor a bit further, I'd point out that a living tree is considerably more resilient than a dead tree, and is likely to adapt to conditions which might otherwise destroy it. I don't think anyone can seriously claim that the c…
I find it extremely disingenuous to say that because the Canadian (or British) Constitution can easily be re-interpreted in different contexts, that it will always be interpreted in 'the correct way.' You seem to be pointing to examples of the US Constitution being interpreted poorly, making the implication that a 'dead tree' constitution can only be interpreted poorly, and a 'living tree' constitution can only be in…
Prof. Ross Anderson's response to a takedown request about security research
51–56 of 56 posts
Re: Prof. Ross Anderson's response to a takedown request about security research
#52Earlier quoted context omitted.
Chip cards cannot be "replayed" or cloned, that's why there's a chip in the first place. The chip stores card's private key that is used to digitally sign a (purchase) transaction. Each transaction is a multi-message exchange in real-time between the terminal and the bank and it includes an unique ID generated by the bank, which is covered by the signature. This effectively prevents a replay. The private key cannot b…
Each transaction is a multi-message exchange in real-time between the terminal and the bank and it includes an unique ID generated by the bank That may or may not be case (there is no way for customers to check that), but the problem is that this encrypted communication is between some third party's terminal and my bank, not between my chip and my bank. IIRC correctly, the protocol in the end boils down to: - bank as…
- bank asks terminal "Here's a random token, have the chip sign it with its private key"
- terminal asks the customer for the PIN
- terminal feeds PIN into the chip, and this enables signing function
- terminal feeds bank's token into the chip, gets the signature back and forwards it to the bank
What you described looks like something designed by a layman with very basic understanding of the cryptography. I will not be shocked if this was in fact deployed, but I still find it very unlikely.
Re: Prof. Ross Anderson's response to a takedown request about security research
#53Earlier quoted context omitted.
Each transaction is a multi-message exchange in real-time between the terminal and the bank and it includes an unique ID generated by the bank That may or may not be case (there is no way for customers to check that), but the problem is that this encrypted communication is between some third party's terminal and my bank, not between my chip and my bank. IIRC correctly, the protocol in the end boils down to: - bank as…
Actually, no, that's not how it worked when I last looked at it. At the high-level it was: - bank asks terminal "Here's a random token, have the chip sign it with its private key" - terminal asks the customer for the PIN - terminal feeds PIN into the chip, and this enables signing function - terminal feeds bank's token into the chip, gets the signature back and forwards it to the bank What you described looks like so…
A man in the middle can hide the "check this PIN" request that the terminal sends from the chip and send a "PIN is OK" reply to the terminal. That way, the terminal thinks PIN check succeeded, and the chip thinks it is doing a payment without PIN check.
Re: Prof. Ross Anderson's response to a takedown request about security research
#54Earlier quoted context omitted.
I find it extremely disingenuous to say that because the Canadian (or British) Constitution can easily be re-interpreted in different contexts, that it will always be interpreted in 'the correct way.' You seem to be pointing to examples of the US Constitution being interpreted poorly, making the implication that a 'dead tree' constitution can only be interpreted poorly, and a 'living tree' constitution can only be in…
The U.S. Constitution absolutely cannot be amended by Congress.
Re: Prof. Ross Anderson's response to a takedown request about security research
#55Earlier quoted context omitted.
The Congress shall have Power... To regulate Commerce with foreign Nations, and among the several States, and with the Indian tribes;" It's not really a matter of living versus dead trees. The US judicial system has just plainly ignored the "among the several States" caveat for the last 100 years. I'm not advocating either side of this example, by how does growing and consuming marijuana on your own property fall und…
Without endorsement, as a result of reading the recent Virginia decision on the constitutionality of the health care purchase mandate (which I mention without endorsement of either side), it has been ruled by the Supreme Court in Wickard v. Filburn (1942) [1] that the US government can regulate the act of a farmer growing wheat to feed his own chickens on the grounds that had the farmer not grown that wheat, he would…
If the Federal Government can regulate growing a half-dozen cannabis plants for personal
consumption (not because it is interstate commerce, but because it is inextricably bound up
with interstate commerce), then Congress' Article I powers -- as expanded by the Necessary
and Proper Clause -- have no meaningful limits. Whether Congress aims at the possession of
drugs, guns, or any number of other items, it may continue to "appropria[te] state police
powers under the guise of regulating commerce."
[1]: http://en.wikipedia.org/wiki/Gonzales_v._RaichRe: Prof. Ross Anderson's response to a takedown request about security research
#56Earlier quoted context omitted.
The U.S. Constitution absolutely cannot be amended by Congress.
Amended by Congress with the approval of the States. It's a slight difference. In the grand scheme of things like checks and balances, it matters, but in the real-world Congress is the only one that has the power to start the process. The States themselves can't float a Constitutional amendment so far as I understand it.