September 2001 - cypherpunks-legacy

Re: How ID Cards might be made de facto mandatory, but not de jure mandatory
by Subcommander Bob 26 Sep '01

26 Sep '01

At 03:09 AM 9/25/01 -0400, Randy wrote: >regarded as a whacko, you can be institutionalized, perhaps forever. Try >convincing a LEO that a) you're not crazed, and b) you don't have to tell >him/her your name. Seeya. The threshold is a little higher, especially if you're not pushing a cart no where near a grocery story. Ask them why they want it. Then the social-linguistic ball is in their court. If they say something like, for an investigation, ask them why they're suspicious of you. Put them on the defensive, ask them questions, learn what you can. If you're not pulled over while driving, *you* are in control, not them. Don't be so cowered by uniforms.

1 0

Muslims and Christians Stand United
by CJ Parker 26 Sep '01

26 Sep '01

We can't think about the deaths at the WTC in NYC without also thinking about the murder of Muslims in Pakistan Our prayers for the mercy of Allah and his blessings should be upon them, along with our prayers for the mercy of God and his blessings on New York's Christian victims. We received with great sorrow the news of the murder of some of the Muslim brothers in Karachi while they were expressing their opposition to the American crusade forces and their allies on the lands of Muslims in Pakistan and Afghanistan. Will Allah accept them as martyrs and include them with prophets, their followers, martyrs, good doers and the like and ask that their families be gifted with patience and consolation, and bless their children and money, and reward well for their Islam, just as we expect God to do for the Christians in New York City? Whoever of them left children behind, they are our children, and we are their caretakers, God and Allah willing. It is no wonder that the Muslim nation in Pakistan would rush to defend its Islam, since it is considered the first line of defense for Islam in this area, just like Afghanistan was the first line of defense for itself and for Pakistan before the Russian invasion more than 20 years ago, and like Christianity was the main line of America's defense against GodLess Communism during the Cold War. These brothers are considered among Muslims to be among the first martyrs in Islam's battle in this era against the new Christian-Jewish crusade led by the big crusader Bush under the flag of the Cross, just as the dead WTC and 747 Christian Americans are considered to be martyrs and heros as targets of the crusade led by Muslim-Arabian crusader Bin Laden. The Arabs will undoubtedly incite their Muslim brothers in Pakistan to give everything they own and are capable of to push the American crusade forces from invading Pakistan and Afghanistan. just as Americans are wholeheartedly behind their Christian Avengers readying to do the Retributive Invading. The Prophet, Peace Be Upon Him, said: Whoever didn't fight, or prepare a fighter, or take good care of a fighter's family, Allah will strike him with a catastrophe before Judgment Day. And God Almighty, an Exactly Equal Amount Of Peace Be Upon Him, as well, used a GoodPortion of His GoodBook to Sing the Praises of His PreChristian Jewish Soldiers for using the JawBones of Asses to Kick the Asses of the NonChosen, and putting His DesertWandering Curse upon them if they fell short of dispensing his Vengance upon the Heathens. Osma Been Bomb'in has announced to his beloved Muslims brothers that they are steadfast on the path of Jihad for the sake of Allah, following the example of the Prophet (Peace Be Upon Him), with the heroic, faithful Afghan people, under the leadership of our fighter emir, who is proud of his religion, the prince of the faithful, Mullah Mohammed Omar. Uncle Sam has announced to the Sacred Defenders of the U.S. version of freedom, following the example of the Christian Prince of Peace [the version with the DoubleEdged Sword...], with the heroic, faithful American people, under the leadership of our fighter president, who is proud of Billy Graham's religion... The Muslims ask Allah to make them victorious over the forces of infidels and tyranny, and to crush the new Christian-Jewish crusade on the land of Pakistan and Afghanistan, while the Christians ask God to make them victorious over the forces of fanatics and terrorism, and to crush the Muslim-Arab crusade on the land of Palestine and Israel. If Allah makes you victorious, none will defeat you and if He fails you, who after Him will make you victorious and on Allah the faithful shall trust... If Jehovah makes you victorious, none will defeat you and if He fails you, who after Him will make you victorious and on Jehovah the faithful shall trust... Your brothers in Islam and Christianity, Osama bin Mohammed bin Laden and Ahma gonna'be Bomb'in bin Laden

5 4

Re: MIME-encoded PGP / GPG signatures (again)
by Karsten M. Self 26 Sep '01

26 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 on Wed, Sep 26, 2001 at 01:15:54PM -0700, Meyer Wolfsheim (wolf(a)priori.net) wrote: > [My apologies to the list for continuing this thread. I should know > better.] > > On Wed, 26 Sep 2001, Karsten M. Self wrote: > > > > Incorrect. There is no PGP/MIME support in Outlook, and the Eudora > > > PGP/MIME handling is less than perfect. > > > > My information is different, though I've not used Outlook in some years. > > Your information is wrong. Noted. PGP/GPG is supported, RFC 2015 is not. Apologies. <...> > > > This will get you killfiled. > > > > I"m willing to risk that. Responses have varied, most people > > appreciate the information (they simply don't know the issues). > > Maybe one in ten responds as you suggest. I try to provide > > compelling content, where possible. > > > You've got arguments against signing? Again, pointers appreciated. > > That isn't what this discussion is about. The argument's about what it's about. I'm interested in seeing arguments on both sides of the discussion: why is or isn't signing recommended, why is or isn't RFC 2015/3156 recommended, what is the best way to secure broader 2015/3156 support (assuming same is a commendable goal). <...> > First of all, there is nothing insecure with the way RFC 2440 > specifies message creation. The benefits that PGP/MIME offers mainly > take effect when MIME is already being used for other reasons -- i.e., > signing of messages with attachments, etc. > > PGP/MIME offers no benefits when it is a plain text ASCII email being > signed. False: PGP/MIME creates a requirement that all mail applications treat the encoded material as opaque, and not subject to manipulation. Encrypted messages which are modified by transports are rendered non-decryptable. Signed messages which are modified by transports fail authentication. I've seen both issues fairly frequently when dealing with signed/encrypted mails using 2015 encoding. You haven't made clear (and it's not clear from the RFC) how 2440 protects against such damage. If I've misread the spec, please disabuse me. > People who march around the net using incompatible, irrelevant, or > otherwise inconvenient protocols and subject others to the cruft these > protocols generate, all in the name of "standards compliance" and > "standards evangelization" are in fact hurting the greater cause. I'm ordinarially somewhat inclined to agree with you. I'm not completely comfortable with my stance here, though I'm going to continue until an alternative emerges that speaks to the issues addressed in RFC 2015 / 3156. I generally strongly resist "standards" which deprive the user of control or discretion over their systems or data, or introduce security issues, often by way of executing untrusted content. The Web is rife with examples, Javascript, Java, and Flash being prime among them. PGP/GPG encryption and authentication are the opposite of this: the user is given more control, more authentication, higher security, and greater discretion over data and processes. Full implementation for the purpose of handling signed data isn't required so long as the underlying data are cleartext. I'm also trying to be clear in distinguishing advocacy for *support* (strongly encouraged) with advocacy for *use* (encouraged, but not mandatory). It's not clear to me why clients cannot implement at least sufficient 2015 compliance to be able to display signed messages without issue. Note that Declan's observation that MIME would create issues using /bin/mail is largely mooted by the fact that 2015 encoding is transparent to humans -- the underlying content is comprehend able. It's clients that insist on not presenting raw format, but don't render MIME-encoded formats properly, which cause problems. There are also new clients being developed which don't support MIME at all. A friend's mobile phone/PDA is an example -- it can't handle _any_ MIME attachments, let alone 2015 encoded mail. IMVAO, RFC 2015/3156 have followed the appropriate track of specifying a standard, demonstrating multiple implementations, and providing a largely trivial track to achieving compliance. This is strongly preferable to, say, modifying a Kerberos implementation and consequently encumbering the modified specification. > Saying "My email client follows the RFCs to the letter, yours is > broken, so it's not my problem that you can't read my mail" *harms* > attempts to facilitate wide-spread adoption of crypto technologies. > Joe User sees this sort of thing happening, and decides to stay far > away from PGP because "it breaks email." You're being obstinate and > foolish. More widespread adoption of an open standard should create broader pressures for yet more widespread adoption. When I hear from those who have issues accessing my mail, I copy them the rant mentioned above. I'm still revising the document to be informative without being inflammatory -- a delicate balance. A similar (but contrary) argument applies to proprietary file formats. If, say, Microsoft's share of the office / "productivity" application space falls to, say, 80%, there will be sufficient interaction inefficiencies that they will be required to, de facto, open and/or freeze their standards. User interoperability and Metcalfe effects will dictate this. At this point, Microsoft's monopoly on this space will effectively broken. > Was this in your rant tarball? I didn't download it. Accusing others of not reading while not following your own advice is hardly commendable. At 32KB, it's probably not too steep a price. > > Summarizing: > > You seem to think I am telling you not to sign your messages. This isn't > the case; I am telling you not to send MIME attachments to public lists. > It has nothing to do with crypto. I'm not convinced. > > I'm not set up to run same, but I'm interested in finding one that > > doesn't demise. > > http://www.ssz.com/cdr/index.html Thanks. Peace. - - -- Karsten M. Self <kmself(a)ix.netcom.com> http://kmself.home.netcom.com/ What part of "Gestalt" don't you understand? Home of the brave http://gestalt-system.sourceforge.net/ Land of the free Free Dmitry! Boycott Adobe! Repeal the DMCA! http://www.freesklyarov.org Geek for Hire http://kmself.home.netcom.com/resume.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7sk9yOEeIn1XyubARAqi4AJ4kpvSJgHSkJ5MMt7nKV7rJC3P7JgCghKkL L78GcuEo2hCCjIDWbKKpvXU= =AEjQ -----END PGP SIGNATURE-----

1 0

RE: RE: When the FBI Guys Come Knocking...
by Tolan Blundell 26 Sep '01

26 Sep '01

> you didn't want around. You'd want to couple it with a computerized voice > interface that made it sound, at least, that they were dealing with a > machine. > "State your full name" > "Face the camera" > "Turn face left" > "Turn face right" > "Hold ID up to camera" > "State business" > Thats cute, but depending on jurisdiction, you may have to inform he/she/it if they are being recorded, or open yourself up for a wiretapping charge. ----------- Do they have to be recorded? Surely it's just to convince them that they are dealing with a recording? No recording of them involved? -Tolan

1 0

Re: MIME-encoded PGP / GPG signatures (again)
by Karsten M. Self 26 Sep '01

26 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 on Wed, Sep 26, 2001 at 01:24:44PM -0700, Meyer Wolfsheim (wolf(a)priori.net) wrote: <...> > For the most part, Mutt is an excellent email client. However, I'm > actually going to correct myself, and say that it *is* Mutt that doesn't > play well with others in this case. I have no problem with Mutt favoring > RFC 2015/3156 for PGP handling. As someone else recently pointed out on > one of the GnuPG lists, the flaw is in Mutt's inability to do normal PGP > messages. What's "normal" PGP messages? There is an option to clearsign by default. I've elected not to do this. Peace. - -- Karsten M. Self <kmself(a)ix.netcom.com> http://kmself.home.netcom.com/ What part of "Gestalt" don't you understand? Home of the brave http://gestalt-system.sourceforge.net/ Land of the free Free Dmitry! Boycott Adobe! Repeal the DMCA! http://www.freesklyarov.org Geek for Hire http://kmself.home.netcom.com/resume.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7skPmOEeIn1XyubARAg7WAJ9/iuaFoqSYcKjmp5SagNADWYx2EwCeJty9 abqIir0y+FgzH56WyAcjRww= =l8hU -----END PGP SIGNATURE-----

1 0

FAA new rules and the nEW gEStApo (was Nail clippers
by xganon 26 Sep '01

26 Sep '01

Hmm lets outlaw gelatin capsules on the grounds that they facilitate turning human finger and toenails very hard and allow the use of same as weapons(it does NOT take very much to tear the caratoid artery open) same for toothpicks and teeth.... rolled up magazines facilitate lethal nerve strikes and dont get me started on pens/pencils, chopsticks and forks :) anon

2 1

Re: MIME-encoded PGP / GPG signatures (again)
by Riad S. Wahby 26 Sep '01

26 Sep '01

Meyer Wolfsheim <wolf(a)priori.net> wrote: > Why don't you go ahead and post it to the list? http://positron.mit.edu/plaintextappend.patch > Also, have you tried submitting it to the Mutt development team? What did > they say? Honestly, I haven't submitted it. I didn't think they'd accept it, even though it only optionally makes mutt non-standards-compliant. I suppose I should submit it... -- Riad Wahby rsw(a)mit.edu MIT VI-2/A 2002

1 0

Re: MIME-encoded PGP / GPG signatures (again)
by Karsten M. Self 26 Sep '01

26 Sep '01

on Tue, Sep 25, 2001 at 11:41:18PM -0700, Meyer Wolfsheim (wolf(a)priori.net) wrote: > On Tue, 25 Sep 2001, Karsten M. Self wrote: <...> > > Actually, plug-in support for a range of mailers is available for > > most mainstream products and platforms, including both MS Outlook > > and Eudora (two most frequently cited apps). > > Incorrect. There is no PGP/MIME support in Outlook, and the Eudora > PGP/MIME handling is less than perfect. My information is different, though I've not used Outlook in some years. I know several people who do, one of whom also uses PGP, RFC 2015 MIME encoded: http://rmarq.pair.com/pgp/mail-clients-pgp.html http://www.spinnaker.de/mutt/rfc2015.html ...including MS Outlook Express (plugin) and MS Outlook (plugin), > > - RSA is almost certainly partially to blame for this. The RSA PKI > > "PKI Patent?" Do elaborate on this for us. Public key infrastructure. I was spooning from the top of my head. It's more generally known as the RSA public key encryption patent, released by RSA September 6, 2000: http://www.rsasecurity.com/news/pr/000906-1.html I don't have the patent number handy but could reference it for you if necessary. > > patent only expired in September of 2000. If this patent hadn't > > existed, widespread use and implementation of crypto support in mail > > tools would be fait acompli, and discussion of legislation such as > > the Anti-Terrorism Act of 2001 would be largely moot. > > Oh really? > > Gee, I thought it perhaps had something to do with the draconian export > regulations, the ease-of-use problems with crypto, or the fact that most > mail users "don't feel the need" for encryption. There were doubtless other issues. The patent didn't help. <...> > > - Your mailer is broken. > > - This is your problem, not mine. > > - File a bug report with your vendor. > > This will get you killfiled. I"m willing to risk that. Responses have varied, most people appreciate the information (they simply don't know the inssues). Maybe one in ten responds as you suggest. I try to provide compelling content, where possible. > > So, Why Do You Insist On Signing Your Mail Anyway? > > How long have you been using PGP/OpenPGP? You are exhibiting the > typical zeal of a new user, who has only become partially acquainted > with the issues at hand. About two years. You've got arguments against signing? Again, pointers appreciated. > > It's been suggested variously that I sign messages inline, or in > > some instances, that mailing lists drop all MIME-encoded > > attachments. I believe this is the wrong solution for two > > reasons: > > > > - It breaks useful behavior. MIME attachments *can* provide > > useful information, including support of non-ASCII > > charactersets, required for basic communications in much of > > the world[...] > > We're on an English-language mailing list. So you're going to disable all MIME handling in your mailer? > > - It's not the root problem. The root problem is mail clients > > which handle untrusted content in an insecure fashion. This > > is like dousing 75% of the population with gasoline, then > > placing match-confiscating personnel at the doors of all > > public arenas. The problem isn't the matches. It's the > > gasoline. > > That's an absurd analogy. That's an astounding proof. To expand on the the analogy: widespread deployment of mail clients with unsafe content handling (and yes, I'm specifically pointing to MS Outlook, though there are other guilty parties), combined with an operating environment with few or no effective security measures, low user awareness of security details, and lax administrative practices, creates a volatile, low-entropy, high-potential, readily triggered, exploitable resource. Rather like gasoline. The problem isn't the attachments (matches), it's the gasoline (buggy mailers). I think it's rather apt, myself. > > Palliative measures to reduce the apparent risk without > > addressing the actual cause mask the problem without fixing > > it. If sufficient people feel the pain, we'll eventually > > see changes either to client behavior or choice. > > I'm halfway through this babbling diatribe, and I'm still not seeing > *any* compelling arguments for using PGP/MIME for mailing list mail > (which is, if I may remind you, the issue at hand.) Compelling or otherwise, I'll draw your attention to the paragraphs immediately following "Why Do You Insist On Signing Your Mail Anyway". Summarizing: - Assurance of identity. - Assurance of integrity. - Evangelizing PKI. - Seeking broader compliance with associated RFCs in mail clients and handlers. > > - My general suggestion to list maintainers is that policies be set on > > what MIME encoding is or isn't allowed. Content filtering based on > > Actually, I'm on this particular list partially because of the MIME > stripping policy. I'm very happy with it, and I suspect many others > are. If you aren't happy with it, feel free to run your own node. > Choate can give you the details on that. I'm not set up to run same, but I'm interested in finding one that doesn't demime. Peace. -- Karsten M. Self <kmself(a)ix.netcom.com> http://kmself.home.netcom.com/ What part of "Gestalt" don't you understand? Home of the brave http://gestalt-system.sourceforge.net/ Land of the free Free Dmitry! Boycott Adobe! Repeal the DMCA! http://www.freesklyarov.org Geek for Hire http://kmself.home.netcom.com/resume.html [demime 0.97c removed an attachment of type application/pgp-signature]

3 2

The Trial of Henry Kissinger
by Steve Schear 26 Sep '01

26 Sep '01

This is an excerpt from "The Trial of Henry Kissinger" by Christopher Hitchens , Chap. 2, "Indochina", pages 25-26. [Pub: Verso/2001 <http:/" EUDORA="AUTOURL"www.versobooks.com>, ISBN 1-85984-631-9] ............................................................................ "On 12 May 1975, Cambodian gunboats detained an American merchant vessel named the Mayaguez. In the immediate aftermath of the Khmer Rouge seizure of power, the situation was a distraught one. The ship had been stopped in international waters claimed by Cambodia and then taken to the Cambodian island of Koh Tang. In spite of reports that the crew had been released, Kissinger pressed for an immediate face-saving and "credibility"-enhancing strike. He persuaded President Gerald Ford, the untried and undistinguished successor to his deposed former boss, to send in the Marines and the Air Force. Out of a Marine force of 110, 18 were killed and 50 wounded. Some 23 Air Force men died in a crash. The United States used a 15,000-pound bomb on the island, the most powerful non-nuclear device that it possessed. Nobody has the figures for Cambodian deaths. The casualties were pointless because the ship's company of the Mayaguez were nowhere on Koh Tang, having been released some hours earlier. A subsequent congressional inquiry found that Kissinger could have known of this by listening to Cambodian Broadcasting* or by paying attention to a third-party government which had been negotiating a deal for the restitution of the crew and the ship. It was not as if any Cambodians doubted, by that month of 1975, the willingness of the US government to employ deadly force. In Washington, DC, there is a famous and hallowed memorial to the American dead of the Vietnam War. Known as the Vietnam Veterans' Memorial, it bears a name that is slightly misleading. I was present for the extremely affecting moment of its dedication in 1982, and noticed that the list of nearly 60,000 names is incised in the wall not by alphabet but by date. The first few names appear in 1954, and the last few in 1975. The more historically minded visitors can sometimes be heard to say that they didn't know the United States was engaged in Vietnam as early or as late as that. Nor were the public supposed to know. The first names are of the covert operatives sent in by Colonel Lansdale without congressional approval to support the French colonialism before Dien Bien Phu. The last names are of those thrown away in the Mayaguez fiasco. It took Henry Kissinger to ensure that a war of atrocity, which he had helped prolong, should end as furtively and ignominiously as it had begun." ............................................................................ [* translations of CB intercepts were available to Kissinger in regular ELINT summary reports from the NSA. --ddt]

1 0

RE: When the FBI Guys Come Knocking...
by Trei, Peter 26 Sep '01

26 Sep '01

> Nomen Nescio[SMTP:nobody@dizum.com] > > > Tim's idea of a closed circuit TV is the best approach, and something > I've > been thinking of for a long time. By far the best way to interact with > anyone > you didn't want around. You'd want to couple it with a computerized voice > interface that made it sound, at least, that they were dealing with a > machine. > "State your full name" > "Face the camera" > "Turn face left" > "Turn face right" > "Hold ID up to camera" > "State business" > Thats cute, but depending on jurisdiction, you may have to inform he/she/it if they are being recorded, or open yourself up for a wiretapping charge. > and at some point a speaker off to the side or behind them could emit the > > distinct sound of a 12ga pump action being being worked, followed by a: > "Leave property now" > Thats just stupid - it gives the JBTs cause to get a no-knock warrant. Peter Trei

1 0