October 2002 - cypherpunks-legacy

RE: What email encryption is actually in use?
by Udhay Shankar N 03 Oct '02

03 Oct '02

At 06:50 PM 10/2/02 -0700, Lucky Green wrote: >Steven raises an interesting point. Having looked at various STARTTLS >implementations it appears to me that if not the designers of STARTTLS >then at least the authors of STARTTLS-enabled MTAs appeared to have >envisioned the use of STARTTLS primarily to secure and authenticate >email submission, not MTA-to-MTA SMTP transfer. I agree. In fact, the primary reason I use (and recommend) STARTTLS is to defeat logging by snoopy employers and/or clients. Udhay -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: JYA ping
by Graham Lally 03 Oct '02

03 Oct '02

Eugen Leitl wrote: > On Wed, 2 Oct 2002, Anonymous wrote: > >>Cryptome has nor been updated since 9/23 ... any clues, anyone ? > > No. Anyone knows whether John Young is okay? Can't get through to http://www.jya.com/ either (plus Google hasn't cached it, for some reason...?) - can't resolve it at all.

1 0

cypherpunks, Over 40? This is a MUST..
by Cilya Barr 03 Oct '02

03 Oct '02

1 0

Re: What email encryption is actually in use?
by Adam Shostack 03 Oct '02

03 Oct '02

On Wed, Oct 02, 2002 at 09:12:47PM +0100, Ben Laurie wrote: | Adam Shostack wrote: | >On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: | >| Lucky Green wrote: | >| >I also agree that current MTAs' implementations of STARTTLS are only a | >| >first step. At least in postfix, the only MTA with which I am | >| >sufficiently familiar to form an opinion, it appears impossible to | >| >require that certs presented by trusted parties match a particular hash | >| >while certs presented by untrusted MTAs can present any certificate they | >| >desire to achieve EDH-level security. | >| | >| This is probably a stupid question, but... why would you want to do this? | > | >So that your regular correspondants are authenticated, while anyone | >else is opportunisticly encrypted. | | ??? How does checking their MTA's cert authenticate them? What's wrong | with PGP sigs? Consistency with last time. Whats wrong with PGP sigs is that going on 9 full years after I generated my first pgp key, my mom still can't use the stuff. Sure, you and I can use PGP, but by and large, people don't bother. So lets look at a technology that's getting accepted, and improve it slowly. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 2

Re: What email encryption is actually in use?
by Dave Howe 02 Oct '02

02 Oct '02

James A. Donald wrote: >> And PGP tells me "signature not checked, key does not meet > validity threshold" what version are you on? ckt never does that - it checks it, and marks the sig status as good or bad - but obviously marks the key status as invalid (due to lack of signing) on anyone I don't trust enough to sign :) oh - and some versions of pgp have trouble with that particular key - its a 4K RSA that V5.x would accept, but V6.x wouldn't Try 6.5.8 CKT instead :)

2 1

RE: What email encryption is actually in use?
by Lucky Green 02 Oct '02

02 Oct '02

Ben wrote: > Lucky Green wrote: > > I also agree that current MTAs' implementations of STARTTLS > are only a > > first step. At least in postfix, the only MTA with which I am > > sufficiently familiar to form an opinion, it appears impossible to > > require that certs presented by trusted parties match a particular > > hash while certs presented by untrusted MTAs can present any > > certificate they desire to achieve EDH-level security. > > This is probably a stupid question, but... why would you want > to do this? To protect against MIM attacks on the encrypted tunnel between the trust domains represented by my friend's MTA and my MTA. --Lucky Green

1 0

Re: JYA ping
by Eugen Leitl 02 Oct '02

02 Oct '02

On Wed, 2 Oct 2002, Anonymous wrote: > Cryptome has nor been updated since 9/23 ... any clues, anyone ? No. Anyone knows whether John Young is okay?

1 0

Re: What email encryption is actually in use?
by Adam Shostack 02 Oct '02

02 Oct '02

On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: | Lucky Green wrote: | >I also agree that current MTAs' implementations of STARTTLS are only a | >first step. At least in postfix, the only MTA with which I am | >sufficiently familiar to form an opinion, it appears impossible to | >require that certs presented by trusted parties match a particular hash | >while certs presented by untrusted MTAs can present any certificate they | >desire to achieve EDH-level security. | | This is probably a stupid question, but... why would you want to do this? So that your regular correspondants are authenticated, while anyone else is opportunisticly encrypted. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: What email encryption is actually in use?
by Major Variola (ret) 02 Oct '02

02 Oct '02

The problem Mr. Howe describes is fundamental, folks: encryption should be end-to-end even when the endpoints are functionaries in a company. Because not all employees are equal. So yes Alice at ABC.COM sends mail to Bob at XYZ.COM and the SMTP link is encrypted, so the bored upstream-ISP netops can't learn anything besides traffic analysis. But once inside XYZ.COM, many unauthorized folks could intercept Bob's email. Access Control is sorely lacking folks. Link encryption is a good idea, but rarely sufficient. At 01:20 PM 10/1/02 +0100, David Howe wrote: >at Tuesday, October 01, 2002 3:08 AM, Peter Gutmann ><pgut001(a)cs.auckland.ac.nz> was seen to say: >> For encryption, STARTTLS, which protects more mail than all other >> email encryption technology combined. See > >I would dispute that - not that it isn't used and useful, but unless you >are handing off directly to the "home" machine of the end user (or his >direct spool) odds are good that the packet will be sent unencrypted >somewhere along its journey. with TLS you are basically protecting a >single link of a transmission chain, with no control over the rest of >the chain.

5 5

Lose up to 10 pounds FREE with TrimLife!
by quickclickbingo 02 Oct '02

02 Oct '02

Dear , Trimlife is so sure that you can lose 5-10 pounds in 7 to 10 days we want to send you a 7-day supply of our amazing Herbal Weight-loss tablet FREE. Click Here to Get Started! http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/ <a href="http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/"> AOL Users Click Here</a> That's right, you read correctly, we want to send you a FULL 7- DAY SUPPLY FREE! Well also give you your own Personal Weight-loss Counselor to provide you with lots of Health and Weight-loss tips and secrets daily! And, Well even send you the link to our fabulous new TrimLife E-Book 101 Top Secret Fat Burning Recipes Tips, Tricks, and Much More! - The book is a $39.95 value, Its yours FREE. All you pay is the mailing cost of One Dollar. Don't let Just $1.00 stand between you and melting off 5-10 pounds in 7 days. How do you get this FREE SAMPLE? It's easy! Just click here. Thanks! Click Here to Get Started! http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/ <a href="http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/"> AOL Users Click Here</a> ==================================================================== Update your profile or unsubscribe here: http://topica.email-publisher.com/survey/?a84EO7.baSzWR Delivered by Topica Email Publisher, http://topica.email-publisher.com/

1 0