November 2002 - cypherpunks-legacy

Re: What email encryption is actually in use?
by David Howe 04 Nov '02

04 Nov '02

at Monday, November 04, 2002 2:28 AM, Tim May <tcmay(a)got.net> was seen to say: > Those who need to know, know. Which of course is a viable model, provided you are only using your key for private email to "those who need to know" if you are using it for signatures posted to a mailing list though, it just looks silly. > You, I've never seen before. Even if you found my key at the Liberal > Institution of Technology, what would it mean? it would at least give us a chance to check the integrity of your post (what a sig is for after all) and anyone faking your key on the servers would have to prevent you ever seeing one of your own posts (so that you can't check the signature yourself) > Parts of the PGP model are ideologically brain-dead. I attribute this > to left-wing peacenik politics of some of the early folks. The Web-of-Trust model is mildly broken - all you can really say about it is that it is better than the alternatives (X509 is not only badly broken, but badly broken for the purpose of hierachical control and/or profit) In the current case, one reason to sign important posts is to establish a pattern of ownership for posts, independent of real-world identity. If I know that posts a,b & c sent from nym x are all signed, I will be reasonably confident that key y is owned by the normal poster of nym x. that I don't know who that is in meatspace is pretty irrelevant. Where both systems break down is when trying to assert that key y is tied to anything but an email address (or possibly a static IP). There is little to bind a key to anything or anyone in the real world, unless you meet in person, know each other reasonably well (if only via third parties that can identify you both) and exchange fingerprints. in fact, WoT is simply an attempt to automate this process offline, so that you can be "introduced" to someone by a third party without all three of you having to meet; you still have to make a value judgement based on how sure you are about the third party's reliability and how confident they seem about the identity of x - however in the real world, both of those are vague, hard-to-define values and in the WoT they are rigid (you have a choice of two levels of trust for an introducer, and no way to encode how much third parties should rely on your identification)

1 0

Intel's LaGrab
by Tim May 04 Nov '02

04 Nov '02

"New PCs Likely to Cede Some Control Sun Nov 3, 1:58 PM ET By MATTHEW FORDAHL, AP Technology Writer SAN JOSE, Calif. (AP) - To thwart hackers and foster online commerce, the next generation of computers will almost certainly cede some control to software firms, Hollywood and other outsiders. That could break a long-standing tenet of computing: that PC owners ultimately control data on their own machines. Microsoft calls its technology "Palladium." Intel dubs it "LaGrande." " I say we call it "LaGrab." --Tim May "Extremism in the pursuit of liberty is no vice."--Barry Goldwater

2 1

中国教育网：汕头大学研究生正在招生
by owner-cypherpunks＠minder.net 04 Nov '02

04 Nov '02

1 0

Re: What email encryption is actually in use?
by David W. Hodgins 04 Nov '02

04 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- If you signed your messages on a regular basis, it would let me know whether or not you're the same Tim May, I've been reading since back when toad.com was the only server for the list. If you're key was signed by anyone I've dealt with, who I know will actually check your id, it would increase my confidence that you really are Tim May, and not just a net persona. It doen't make one iota of difference, whether you choose to distribute your key or not. Your ideas are usually thought provoking, and consistent enough to form a persona in the minds of the list readers. Or at least, in mine. I know you know (whether or not you agree) with the above. It just struck me as humourous that you'd sign the post, with the comment to the effect that there isn't much point in doing so, with a key that isn't on the servers. Do you see the PGP web of trust as completly useless? As to who I am, well... I'm a programmer, living in London, Ont. Canada. I've been lurking, off and on, since 94 or so. I don't think I've actually posted anything to the list since back in 96, when I wrote a freeware program to simplify using PGP with dos based offline mail readers (MPI.ZIP). While I normally promote privacy issues, only with those I meet face to face, I still consider myself a cypherpunk. I normally only post to the list, when my point of view isn't being expressed by any of the regular posters. Regards, Dave Hodgins. Tim May wrote: > > On Sunday, November 3, 2002, at 06:14 PM, David W. Hodgins wrote: > > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > > The advantages really disappear, when the key used to sign the > > message > > isn't sent to the key servers {:. > > > > Those who need to know, know. > > You, I've never seen before. Even if you found my key at the > Liberal Institution of Technology, what would it mean? > > Parts of the PGP model are ideologically brain-dead. I attribute > this to left-wing peacenik politics of some of the early folks. > - --Tim May -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQEVAwUBPcXu94s+asmeZwNpAQFQuAf+LbwrdQV8CPAc/lw2AF5HPvKLGopHCj3i tFR+drfFAYDDA6UHMPJOFxzDdhFYrRbhQ3c3cSkExSSoI7Mce389KPdGimWQZTJZ rCYyvnXtG+S//ya8yCELXC3SSwwra0+laPpoSz6lseIU6YJUYFyMLnnXaH5gpxHi O7TtK8kfPFQVVdbBuJC4mp9SjNO3DqIM29UbPSrf9KZ1w2zPXA4eov9GL9jjU808 CzT+wncCYaE1EU8cT3C+TFJyd8r8B1S6CLbjX9hC71kIt5bVUt1EHMHUx8u2YaXZ i4o2kKQGePbJvIIiOuwngIUOuwnbgLlGO7+zhsL4y2UuXeJ1/W5NVQ== =8BJt -----END PGP SIGNATURE-----

1 0

Re: What email encryption is actually in use?
by Bill Stewart 04 Nov '02

04 Nov '02

At 12:41 PM 11/02/2002 -0500, Steve Furlong wrote: >The only business environment I've ever worked in which successfully >used encrypted email mandated specific versions of mail client >(Outlook, ecch) and PGP (integrated into Outlook), had a jackbooted >thug to make sure everyone's keyring was up to date, and had a fairly >small (couple dozen), mostly technically proficient, user base. And >even there, half the time the encrypted message wasn't sensitive enough >to be worth encrypting nor important enough to be worth decrypting. All of the business email I send from home is encrypted - not by the mail user agent or mail transfer agent, but by the VPN I use to reach my work intranet. If it goes outside the company, it's normally not encrypted. (Also, non-business email I send when VPN-connected is encrypted, on the dialup portions, but not past that.) What would be really nice, and would encrypt a large chunk of the US's business email, would be for MS Exchange / Outlook mail servers to adopt STARTTLS for their SMTP services.

1 0

Re: What email encryption is actually in use?
by David W. Hodgins 03 Nov '02

03 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- The advantages really disappear, when the key used to sign the message isn't sent to the key servers {:. Regards, Dave Hodgins. Tim May wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > (P.S. I'm going to do something I don't often do: sign a post. > Reasons for not signing posts are manyfold. Advantages are few. But > this is to -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQEVAwUBPcXX8Is+asmeZwNpAQE9dQf/YKjY4AZRXEEdYmYDrDt+IAYmag8EhC31 tMpORG0FlZMzbIbwTCk0f4tAlvJHQXSDHSWLbJznmImMb2uRmYOkAOUdnYvTweCU k65fBFC5ZM988/enSP5y4uJ0HW6iLvPTrUffojHh/gMJZlJ/DGh7BdIUpHKIzE7f zqZB+Z5uyVGpDvYh+pRe1Js9k9XBo/HyYqO862sV8zPs4uVRtRCLwJlOnAsrAPcS 7cTlk2zF1LTr9LOBobNPSiWVq92vJY17kI/Xodasjhzk2/o7SlGCVjCtLlmiEey8 KOuiJfkPsUKNfm6Tn9Nw2hVR51qpBnVIc5KgBgebr/SR9xDjVBSMjQ== =sWNd -----END PGP SIGNATURE-----

1 0

Re: Sending bricks through the mail
by Steve Furlong 03 Nov '02

03 Nov '02

On Sunday 03 November 2002 17:17, Thoenen, Peter Mr. EPS wrote: > Tried emailing direct but bounced so apologize to the list for the OT > content :) > > -----Original Message----- > > From: Major Variola (ret) [mailto:mv@cdc.gov] Peter, you might want to google on "variola major" (not "major variola"), note Maj Variola's alleged host, and consider the possibility it's a nym. -- Steve Furlong Computer Condottiere Have GNU, Will Travel Vote Idiotarian --- it's easier than thinking

1 0

RE: Sending bricks through the mail
by Thoenen, Peter Mr. EPS 03 Nov '02

03 Nov '02

Tried emailing direct but bounced so apologize to the list for the OT content :) You don't happen to have the url do you? Think it would make an amusing read. -Peter > -----Original Message----- > From: Major Variola (ret) [mailto:mv@cdc.gov] > Sent: Sunday, November 03, 2002 18:37 > To: cypherpunks(a)lne.com > Subject: Sending bricks through the mail > > > At 09:37 PM 11/2/02 -0800, Tim May wrote: > >When I was at Intel we sent our designs for microprocessors > to European > > >branches and/or partners. One set of designs sent to MATRA/Harris, a > >partner in the 80C86, was stolen in transit. (The box of > tapes arrived > >in Paris, but the tapes had been replaced by the suitable weight of > >bricks.) > > There exists a website by someone who enjoyed sending unusual things > through the US mail. He once sent a brick, with proper postage, > no envelope. > > The brick *eventually* arrived at its destination, sort of, > but had been > broken > by the DEA according to the PO's paperwork.

1 0

RE: Sending bricks through the mail
by Thoenen, Peter Mr. EPS 03 Nov '02

03 Nov '02

<--smax self :) > -----Original Message----- > From: Steve Furlong [mailto:sfurlong@acmenet.net] > Sent: Sunday, November 03, 2002 23:28 > To: cypherpunks(a)lne.com > Subject: Re: Sending bricks through the mail > > > On Sunday 03 November 2002 17:17, Thoenen, Peter Mr. EPS wrote: > > Tried emailing direct but bounced so apologize to the list > for the OT > > content :) > > > > -----Original Message----- > > > From: Major Variola (ret) [mailto:mv@cdc.gov] > > Peter, you might want to google on "variola major" (not "major > variola"), note Maj Variola's alleged host, and consider the > possibility it's a nym. > > -- > Steve Furlong Computer Condottiere Have GNU, Will Travel > > Vote Idiotarian --- it's easier than thinking

1 0

Integrated crypto sounds useful, but it's fragile and ultimately a lose
by Tim May 03 Nov '02

03 Nov '02

On Sunday, November 3, 2002, at 12:19 PM, Tim May wrote: > As with the situation a decade ago, there are: > > * several OSes in use (2-3 in Wintel world, 2 in Mac world, plus > outliers) > * various release versions of each > * about 5-8 major mail programs covering these platforms > * about 3-5 major newsreader programs And I forgot to mention Linux... Anyway, this is "tower of Babel" situation we have always faced with trying to tightly integrate crypto with apps and OSes. > Several times over the past decade I have heard people urge others to > change their mailer to one that is supported. > > This is even worse than "not one-click operation," as it asks users to > abandon programs and OSes they like or need in order to obtain a > marginal gain of sending a receiving encrypted messages with one click. To expand on this point a bit, I suspect one of the main reasons people who once used PGP stop using it, either privately or at corporations (as we have heard folks here testify about), is because something changes and things "break." They upgrade their OS, they get a new release of a mailer, and things break. And they don't have the time, energy, or inclination to track down all of the little gotchas that may have cause things to break. I know this happened to me several times over the years with various versions of PGP, Eudora, and Mac OS 7, 8, and 9. And I expect that if and when I upgrade my OS, or Mail program, and PGP breaks, I'll be without PGP until it all becomes straightforward again. Expecting people to use mailer and OSes other than the ones they already use just so they can get a bunch of "Hey, isn't this PGP rilly cool?" unsolicited messages is silly. (Which is why, to harp on it, I would favor a very clean text-only approach. Then there would be a slight amount more work needed, but not the breakage we see.)

1 0