December 2003 - cypherpunks-legacy

Re: Certificate proposal
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510120147.LAA13833(a)sweeney.cs.monash.edu.au>, Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: > What you are missing is that you should not say > "I want to send my credit card number to Egghead Software" > you should say > "I want to send my credit card number to 12 34 56 78 9A BC DE F0" Why does this sound so much like defining the problem away? Maybe I just don't get it... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH8QCSoZzwIn1bdtAQFm1QGApigaZIVNZTghR9YrzwL/1dMCdu5zGMK5 QPCEJPY2W1hTrL/znVMkcOCg/Tw5ampO =+2Co -----END PGP SIGNATURE-----

1 0

Re: Netscape beta 2.0 [NOISE]
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510130224.TAA04729(a)infinity.c2.org>, sameer <sameer(a)c2.org> wrote: > Hey those shirts aren't measly! Very comfy, in my opinion :-) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH8RzCoZzwIn1bdtAQGRTwGAzGuG7xyQyNmF7MZZpdU+1Wtx7tjmC1an rnhYqyrNV/9XS3qLe789f8epr1/OsUE8 =cnDM -----END PGP SIGNATURE-----

1 0

Re: responce to graphic encryption replies
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

> ... The graphic file is going to have a highly correlated > structure, long runs of white space etc. This is not the case for digital imagery. For any given band, if you sample a significant portion of the image it would not be surprising to see a more or less random distribution over the range. > The statistics for such a file > would be different than the random distribution you'd get from using the > wrong key. If you decrypt with the wrong key, do you get a random distribution? Would this be the case for all wrong keys? Would the statistics change in any discernible pattern as the keys got "closer"? > Even if the graphics format is compressed, leading to a more > even distribution, ... This may give a better result. Most compressions involve a shift to the frequency domain with a quantization of the samples. You might be able to write a detector based on this discontinuity. You could also try throwing an edge detector or some other morphological recognizer at the output. It would still be cheaper than having to a man in the loop, but you're going to spend a lot of cpu time. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

2 1

Re: applications
by Steve Bryan 17 Dec '03

17 Dec '03

At 5:50 pm 10/13/95, cYberpUnc wrote: > I know this isnt what you guys generally talk about but I was curious. >Off the top of your head do you know of any sites where I can get kracking >apps for macs? Any information would be greatly appreciated. Before looking at the address information I was going to send a one line: "Go away" reply to the question. I thought you promised to try to be less obnoxious. If you'd calm down and read the list for a while you might realize why this might not be the place to pose such questions. Why not take a look at the newsgroup alt.2600? You might find it a rather rude place to frequent and I'd certainly never send my 13 year old there (my oldest is currently 8) but I get the impression the topics you'd find there might prove more interesting than the political and/or technical discussions you'll find here. By all means enjoy yourself here but spend more time listening. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)gofast.net |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

Re: Anguilla Cypherpunks Meeting
by cman＠communities.com 17 Dec '03

17 Dec '03

[various comments about extraterritorial reach] Laws that affect the behavior of citizen-units, no matter where they go, rest on the theory of "personal jurisdiction". Note that in addition to ITAR, the various laws on money laundering, as well as the RICO statues, apply to US citizens wherever they may be. Ditto for tax laws -- one of the little gems that I learned last week was that penalties to failure to report worldwide income are going to be substantially increased. I guess they're not getting very good compliance for some reason...

1 0

Re: Netscape question transformed
by carolann＠censored.org 17 Dec '03

17 Dec '03

And some of us wish 2.0 would show images (the windoze 16 version) And I'm not even clever, and have downloaded three copies. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. > > --Jeff > >-- >Jeff Weinstein - Electronic Munitions Specialist >Netscape Communication Corporation >jsw(a)netscape.com - http://home.netscape.com/people/jsw >Any opinions expressed above are mine. > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

AP on trashing/computer fraud ring
by cman＠communities.com 17 Dec '03

17 Dec '03

Although I generally agree that capturing information online has certain advantages to the criminal over going through the trash, that certainly didn't stop this bunch. Doug [wondering if this will affect the market for home shredders] ======================= ATLANTA (AP) -- Thirty people have been charged in a $10 million fraud scheme that involved counterfeiting checks, bank statements and credit card receipts pulled out of the trash. ``What we're finding is people are getting more and more clever with what they pull out of the trash,'' U.S. Attorney Kent Alexander said. ``This is the most clever scam I've ever seen.'' The defendants, who defrauded people in 17 states, used checks, bank statements, credit card receipts and other documents from garbage bins to create counterfeit checks, false driver's licenses and false credit reports, Alexander said. Investigators said software was used to rub out information on the discarded paper. Counterfeit blank checks, printed on high-quality color printers, were allegedly used to defraud banks of $2 million. A core group of about eight people moved the operation to Atlanta from New Jersey five years ago because they thought it would be easy to take advantage of Southerners, the prosecutor said. Of the 30 people charged, 24 have pleaded guilty, Alexander said. Twelve of the 24 have been sentenced to jail terms of up to eight years and restitution of up to $218,070.

1 0

airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Roy M. Silvernail wriote: >Have you flown recently? They now ask you this scripted question about >whether you have been approached by anyone you don't know since arriving >at the airport, and warn you not to accept anything from a stranger or >leave your carry-on baggage unattended until you board the plane. The >ticket agent told me it was a "new FAA regulation". I hadn't flown >anywhere for a few years. Anyone know how long this has been happening? > Goodbye freedom, hello police state. >I wonder how long before I need a passport to cross a state line... The US is merely trying to catch up to what the Europeans have been doing for over a decade. In fact, the US still has a way to go. You ought to pass through Heathrow in London some time to see what real airport security looks like. The US security changes are a recent response, starting after the World Trade Center bombing and being stepped up on a continuing basis. Today you need a picture ID to board with your ticket. Tomorrow...? We have lived in relative safety compared to the rest of the world, but I think those days are over. Usual disclaimer. Bob Bruen.

5 4

Netscape rewards are an insult
by fc＠all.net 17 Dec '03

17 Dec '03

The idea that Netscape (like Microsoft) thinks they can get free testing services from all over the net by real experts just by offerring a tee shirt is down right offensive. I have a better idea. How about an open market in break-in software. We crack Netscape and offer the crack code to the highest bidder. Bids start at US$25K per hole. For the insult, Netscape has to outbid the competition by a factor of 2 to get the details of the hole. Here's how it works: - We get a panel of 5 cypherpunk judges who test each claimed hole. - Exploit code is sent to the panel for verification. - If they verify the hole, it is put up for bid. - Winning bidder gets the code for 3 months before it is released on hacker BBS systems throughout the world. - The panel of judges splits 25% of the money paid for the code as pay for their efforts. The rest goes to the author. I have an even better idea. How about if Netscape gets some competent programmers with real security expertise, adds in some good change controls, a serious internal testing program, quality control ala ISO-9000, internal IT auditors, external IT auditors, training and education for their employees, and everything else it takes to be in the software business in a serious way. As an alternative, we could help them contact the shareholders for a lawsuit. After all, they are a public company now and are responsible to the shareholders for the value of their stock. If it goes down because they aren't doing an adequate job of software quality control, the officers may be personally liable. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

7 8

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: > The idea that Netscape (like Microsoft) thinks they can get > free >testing services from all over the net by real experts just > by offerring >a tee shirt is down right offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors, which are piling now, on MS being a Peeping Tom when it comes to hard drives are true, I wonder if there might be a way to send a byte bomb to their bit bucket??.......

1 0

Re: Netscape question transformed
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:12 PM 10/13/95 -0700, jsw wrote: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so >> hackers have time to find bugs before the full version is released. Don't >> take me wrong I have only been on the net fer a little over a year and Love >> Netscape. And If I knew what I was Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the >company, it is virtually impossible to get complete testing coverage. >Given the incredible variety of machines, OS's, peripherals, etc. >that are available in the real world, there is no way we could >re-create every possible configuration in the lab. I think that the main reason people have problems with the testing offer on the beta is the lack of responses to bugs in the past. I have seen many complaints from people on the net complaining that bugs they had reported in .90 had continued on into new and continued versions. That if they recieved a message back from Netscape it was just an infobot, and a rather hostilly worded one at that. (The infobot has been lightened up a great deal.) Netscape has never had the staff to properly respond to the mail volume they have recieved. They have been trying to improve this but it is difficult to man such a project with people who are able to sort through the piles of dreck to find those people reporting serious problems. (Also, the bug rewards are only for "serious bugs". Who defines what is serious and what is not. I know of a couple that have been hanging around for a couple of versions now. Maybe I should test if they got fixed with 2.0b1. Probibly not. They only hit a handful of people.) Netscape is still a pretty new company. Some seem to forget that .90 was only released about a year ago. How long does it take to get a proper QC department in place? (After the shakeup in February(?) when the new President was hired, I would have thought it would have been done then. Now I am not so sure...) I know of at least one product that went out the door in recient months that was not properly tested. (The stack and dialer used with Netscape PE comes to mind.) I realize that sales sometimes forces things to be released before its time, but there has to be some basic controls for quality control. (I will not mention some of the bigger gaffes with 1.0 and 1.1 since not all of those were publicized. A few simple things could have caught them before they went out the door.) I want to see Netscape succeed, but when you hear about things like product being released on the net without warning those people responsible for supporting it, bug reports being ignored so a ship date can be made, and the like, it makes you really wonder. I am finding problems with 2.0b1 that could have been found just by using the product for a couple of days! Most of the problems I have seen with Netscape could be solved with better communications between departments within the company and some strong testing procedures. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. Somethings are real simple. Things like giving it to a handful of people and letting them use it for a couple of days before you release it to the rest of the world. 90% of the bugs will be pointed out through having someone beat on it as they would any other peice of software. And those people should be someone other than the programmers. (Sometimes you get too close to the code to really stress it properly.) I agree that you need to have a beta program. Not everything can be tested. But QC is important. This is not Uncle Jim's pet project anymore... All of this has been brought up on the net before. Sometimes it seems like the responses are more defensive than trying to find out the real problems and fix them. So far, you have been one of the few who has pushed for getting some of these things fixed in a timely manner. (I can name a few others as well. They seem to get burned out after a while though...) I think my biggest questions right now are: "Is there a formal testing procedure for product that is about to go out the door? Is there a real QC department and do they have the power to stop releases if significant problems are found?" | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

[URGENT] Where are we meeting today?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, I spaced the announcement and I can't find it in the archive. Somewhere at Sun... Would someone please forward me the original post? TIA, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH/+ACoZzwIn1bdtAQGkrgF+JqKcgWrM4VFYaQGbmR6gCg5SBzQe5Php Qv9OxqnfcFFgbs6ZzzMkf+IietdzliuI =SZst -----END PGP SIGNATURE-----

1 0

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: >The idea that Netscape (like Microsoft) thinks they can >get free testing services from all over the net by real >experts just by offerring a tee shirt is down right >offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors of MS being a Hard Drive Peeping Tom are true, then I wonder if there might be a way to send a byte bomb to their bit bucket??....... Be Well

1 0

Re: [URGENT] Where are we meeting today?
by cman＠communities.com 17 Dec '03

17 Dec '03

Place: Sparcy's cafeteria, building 21, Sun Microsystems Mountain View, California Directions: Take 101 to Amphitheater Parkway. Turn left onto Garcia, and drive about 1/2 mile and turn onto the first genuine side street which is named Marina Way. Drive about 1/4 mile and look for a right hand turn onto Coast. Building 21 will be on your left. It's on the corner of Coast and Marina Way. There's plenty of parking there.

1 0

DSS patent license
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>>> RSA Data Security, Inc. >>> today announced that it is now licensing patents for the Digital Signature >>> Standard (DSS), the U.S. government standard for digital signatures. >> >> I believe someone was suing the U.S. government on the grounds that the >> public signature standard wasn't supposed to require proprietary >> technology. Has this gone anywhere yet? >> >> -- >> Eli Brandt >> eli+(a)cs.cmu.edu Yes, I had such a lawsuit. No, it didn't go anywhere in the courts, but the feds did eventually cave in to the principal demand of my suit: That the DSA patent be made available to anyone on a royalty-free basis. So how is it that RSADSI and Cylink/CKC claim you need licenses to their patents to use DSS? Because they have other patents. I have another lawsuit directed at those patents. Stay tuned. Roger Schlafly rschlafly(a)attmail.com

1 0

Top Math & Physics Sites (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: Certificate proposal
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGF06D.HGJ(a)sgi.sgi.com>, daw(a)lagos.CS.Berkeley.EDU (David A Wagner) writes: > In article <199510120147.LAA13833(a)sweeney.cs.monash.edu.au>, > Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: >> What you are missing is that you should not say >> "I want to send my credit card number to Egghead Software" >> you should say >> "I want to send my credit card number to 12 34 56 78 9A BC DE F0" > Why does this sound so much like defining the problem away? > Maybe I just don't get it... I agree. Sending your cc# to a key or an IP address is not what you want to do. As a consumer, I want to make sure that I send my cc# to the merchant I am buying from. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

ESP_ion
by John Young 17 Dec '03

17 Dec '03

Simone has provided a copy of the LA Times July 23 report on the CIA's economic espionage. ESP_ion (10 kb)

1 0

Re: Netscape rewards are an insult
by Cedric Ingrand 17 Dec '03

17 Dec '03

> I have a better idea. How about an open market in break-in > software. We crack Netscape and offer the crack code to the highest > bidder. Bids start at US$25K per hole. For the insult, Netscape has to > outbid the competition by a factor of 2 to get the details of the hole. You're talking gaping security holes. They're merely talking bugs. I don't know if it's already been covered elsewhere, but I saw Jim Clark at a press conference in Paris a couple of weeks ago, and he more or less laid out what he intended to do about security: "First of all, I am chairing an audit commitee for security. All new security-related and encryption-related mechanisms that we build into our products has to go through this audit commitee before being released. The audit commitee hires outside auditors, security auditors, particularly RSA and experts out of academia, Ron Rivest from MIT and people like this to do the audit of our security systems. Another thing we're doing is publishing the source code which does the security so people can just see what the algorithms are. Had we done that in the first place, if we had published our source code, people wouldn't say 'ha ha! It's easy to guess that you're using this gate as the starting point of the random number'. So we think that by publishing the algorithms, having a security audit by an outsider auditor... it's sort of like the accounting profession, they have an audit commitee on the board of directors, the audit is actually done by an outside financial institution and to some degree it's exactly what's happening in security. We think that we were the first company to introduce this technology to the internet and so we were the first company to come under attack. We were careless, and we're not going to be careless in the future." I haven't seen Netscape deliver on this promise of publishing their encryption code, so I'll keep the promise on tape for a little while (-: Best, Cedric. --------------------------------------------------------- Cedric Ingrand - cedric(a)planetepc.fr - +33.1.43.98.88.56.

1 0

Where to Get PGP
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) FAQ 14 OCTOBER 1995 Long version For questions not covered here, please see the MAIN alt.security.pgp FAQ at ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt WHAT IS THE LATEST VERSION OF PGP? Platform(s) Latest Version Distribution File Names __________________________________________________________________________ | | | | |DOS, Unix, | Viacrypt PGP 2.7.1 | disk sets | |Mac, Windows, | | | |or WinCIM/CSNav | | | |________________|_____________________|_________________________________| | | | | |Hardware-based | Viacrypt 2.7.1 | disk sets | |PGP/Token | | | |________________|_____________________|_________________________________| | | | | |DOS, Unix, VAX, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | |others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262s.tar.gz (source) | | | | pgp262s.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |________________|_____________________|_________________________________| | | | | |Macintosh | MIT PGP 2.6.2 | MacPGP2.6.2-130v1.hqx | | | Mac version 1.3.0 | m262pgp.hqx (same as above) | | | | MacPGP2.6.2-130v1.source.asc | | | | m262pgps.asc (same as above) | |________________|_____________________|_________________________________| | | | | |Power Mac | Zbigniew's "beta" | Fatmacpgp262b131.sea.hqx | | | | f262pgp.hqx (same as above) | | | | Fatmacpgp262b131.src.hqx | | | | f262pgps.hqx (same as above) | |________________|_____________________|_________________________________| | | | | |Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | | | | PGPAmi262is.lha (international) | |________________|_____________________|_________________________________| | | | | |Atari | Atari MIT PGP 2.6.2 | pgp262st.zip | | | Atari International | pgp262ib.zip | |________________|_____________________|_________________________________| | | | | |OS/2 | MIT PGP 2.6.2 | pgp262-os2.zip | | | | on ftp.gibbon.com | |________________|_____________________|_________________________________| | | | | |Non-USA version | PGP 2.6.2i from | pgp262i.zip (DOS executable) | |to avoid RSAREF | Stale Schumacher, | pgp262ix.zip (32-bit DOS) | |license. | Kai Uwe Rommel, | pgp262i-os2.zip (OS/2 exe) | |(various | Harald Denker, and | pgp262ib.zip (Atari) | |platforms) | Peter Simons | PGPAmi262is.lha (Amiga) | | | | pgp262is.zip (source) | | | | pgp262is.tar.gz (Unix source) | | | | | | | Canadian "mutant" | MacPGP262ca124.exe.sea.hqx | | | not for USA use | MacPGP262ca124.src.sea.hqx | |________________|_____________________|_________________________________| | | | | |Unofficial | PGP 2.6.2ui | pgp262ui.zip (executable) | |non-USA version | Not for use in the | pg262uis.zip (source) | |fully under Gnu | USA because of | pg262uix.zip (DOS extended) | |public license | probable patent | | |(based on 2.3a | infringement | | |code) | problems. | | |________________|_____________________|_________________________________| BUG LISTS http://www.ifi.uio.no/~staalesc/PGP/bugs.html http://www.mit.edu:8001/people/warlord/pgp-faq.html WHERE CAN I GET VIACRYPT PGP? Viacrypt has versions of PGP complete with licenses for commercial use of the RSA and IDEA encryption algorithms. Viacrypt PGP comes in executable code only (no source code), but it is based on (and just as secure as) the freeware PGP. Viacrypt PGP for Windows is the only real Windows PGP (and even it is partially a quickwin executable that looks like a DOS port). Still, it is much better from an interface standpoint than all the others. Please contact ViaCrypt for pricing (about US $100 up), the latest platforms, and availablity at 800-536-2664 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. http://www.viacrypt.com If you have further questions, please ask: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I FTP PGP IN NORTH AMERICA? If you are in the USA or Canada, you can get PGP by following the instructions in any of: ftp://net-dist.mit.edu/pub/PGP/README ftp://ftp.csn.net/mpj/README.MPJ ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS ftp://ftp.netcom.com/pub/mp/mpj/README.MPJ ftp://ftp.netcom.com/pub/dd/ddt/crypto/READ_ME_FIRST! ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_ftp_instructions.txt ftp://ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/ ftp://ftp.gibbon.com/pub/pgp/README.PGP http://www.gibbon.com/getpgp.html ftp://ftp.wimsey.bc.ca/pub/crypto/software/README WHERE IS PGP ON THE WORLD WIDE WEB? http://web.mit.edu/network/pgp-form.html http://www.ifi.uio.no/~staalesc/PGP/home.html http://rschp2.anu.edu.au:8080/crypt.html http://www.eff.org/pub/Net_info/Tools/Crypto/ http://community.net/community/all/home/solano/sbaldwin http://www.cco.caltech.edu/~rknop/amiga_pgp26.html http://www.csua.berkeley.edu/cypherpunks/home.html http://www.leo.org/archive/os2/crypt/ http://colossus.net/wepinsto/wshome.html http://www.cs.hut.fi/ssh/crypto/ WHERE IS PGP ON COMPUSERVE? GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. Compuserve file names are limited, so look for PGP262.ZIP, PG262S.ZIP (source code), PGP262.GZ (Unix source code) and PG262D.ZIP (documentation only). AOL Go to the AOL software library and search "PGP" or ftp from ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp. WHAT BULLETIN BOARD SYSTEMS CARRY PGP? MANY BBS carry PGP. The following carry recent versions of PGP and allow free downloads of PGP. US 303-343-4053 Hacker's Haven, Denver, CO Lots of crypto stuff here. 303-772-1062 Colorado Catacombs BBS, Longmont CO 8 data bits, 1 stop, no parity, up to 28,800 bps. Use ANSI terminal emulation. For free access: log in with your own name, answer the questions. 303-914-0031 The FreeMatrix ]I[ 314-896-9309 The KATN BBS 317-791-9617 Computer Virus Research Center (CVRC) BBS, Indianapolis, IN Login Name: PGP USER Password: PGP 501-791-0124, 501-791-0125 The Ferret BBS, North Little Rock, AR Login name: PGP USER Password: PGP 506-457=0483 Data Intelligence Group Corporation BBS 508-668-4441 Emerald City, Walpole, MA 601-582-5748 CyberGold BBS 612-690-5556, !CyBERteCH SeCURitY BBS! Minneapolis MN, - write a letter to the sysop requesting full access. 914-667-4567 Exec-Net, New York, NY 915-587-7888, Self-Governor Information Resource, El Paso, Texas UK 01273-688888 GERMANY +49-781-38807 MAUS BBS, Offenburg - angeschlossen an das MausNet +49-521-68000 BIONIC-BBS Login: PGP WHERE CAN I FTP PGP CLOSE TO ME? AU ftp://ftp.cc.adfa.oz.au/pub/security/pgp23/macpgp2.3.cpt.hqx ftp://ftp.iinet.net.au:mirrors/pgp (Australia ONLY) ftp://plaza.aarnet.edu.au/micros/mac/umich/misc/documentation/howtomacpgp2.7.txt DE ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp ftp://ftp.fu-berlin.de/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz ftp://ftp.tu-clausthal.de/pub/atari/misc/pgp/pgp261b.lzh ftp://ftp.uni-kl.de/pub/aminet/util/crypt ftp://ftp.uni-paderborn.de/pub/aminet/util/crypt ftp://ftp.westfalen.de/pd/Atari/Pgp (Atari) ftp://tupac-amaru.informatik.rwth-aachen.de ES ftp://goya.dit.upm.es ftp://encomix.es/pub/pgp/pgp262i/pgp262i.zip IT ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP FI ftp://ftp.funet.fi/pub/crypt NL ftp://ftp.nl.net/pub/crypto/pgp ftp.nic.surfnet.nl/surfnet/net-security/encryption/pgp NZ ftp://ftphost.vuw.ac.nz ftp://rs950.phys.waikato.ac.nz/pub/incoming/pgp (New Zealand ONLY) SE ftp://leif.thep.lu.se TW ftp://nctuccca.edu.tw/PC/wuarchive/pgp/ UK ftp://ftp.demon.co.uk/pub/amiga/pgp ftp://ftp.ox.ac.uk/pub/crypto/pgp ftp://src.doc.ic.ac.uk/aminet/amiga-boing ftp://unix.hensa.ac.uk/pub/uunet/pub/security/virus/crypt/pgp USA ftp://atari.archive.umich.edu/pub/atari/Utilities/pgp261st.zip (Atari) ftp://ftp.leo.org/pub/comp/os/os2/crypt ftp://wuarchive.wustl.edu/pub/aminet/util/crypt ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.exe.sea… ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.src.sea… ZA ftp://ftp.ee.und.ac.za/pub/crypto/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP HOW CAN I GET PGP BY EMAIL? If you have access to email, but not to ftp, send a message saying "help" to ftpmail(a)decwrl.dec.com, mailserv(a)nic.funet.fi, or ftp-request(a)netcom.com To get pgp 2.6.2i by email: Send a message to pgp(a)hypnotech.com with your request in the Subject: field. Subject What you will get GET pgp262i.zip MS-DOS executable (uuencoded) GET pgp262is.zip MS-DOS source code (uuencoded) GET pgp262is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. WHERE IS MACPGP? ftp://ftp.csn.net/mpj/README.MPJ ftp://ftp.confusion.net/pub/pgp/mac-pgp/README ftp://highway.alinc.com/users/jordyn/mac-pgp/README ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS WHERE IS VAX PGP? Get the full PGP distribution, then get VAXPGP262.TAR.Z from the berkeley site for additional files needed to compile PGP for the VAX and a precompiled version for VAX/VMS 5.5-2. WHERE CAN I GET MORE PGP INFORMATION? http://www.csn.net/~mpj ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt ftp://starfire.ne.uiuc.edu/preston/pgpquick.ps (and pgpquick.doc) http://www.prairienet.org/~jalicqui/ http://www.mit.edu:8001/people/warlord/pgp-faq.html http://draco.centerline.com:8080/~franl/crypto.html http://draco.centerline.com:8080/~franl/pgp/bug0.html http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa_paper.ps.gz http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa.paper http://www.cco.caltech.edu/~rknop/amiga_pgp26.html Email pgp-help(a)hks.net ftp://ds.internic.net/internet-drafts/draft-pgp-pgpformat-00.txt ftp://ds.internic.net/internet-drafts/draft-ietf-pem-mime-08.txt http://www.cis.ohio-state.edu/ ftp://ftp.csn.net/mpj/public/pgp/MacPGP262_manual.sit.hqx http://www-mitpress.mit.edu/mitp/recent-books/comp/pgp-source.html http://web.cnam.fr/Network/Crypto/ (c'est en francais) http://web.cnam.fr/Network/Crypto/survey.html (en anglais) http://www2.hawaii.edu/~phinely/MacPGP-and-AppleScript-FAQ.html ftp://ftp.prairienet.org/pub/providers/pgp/pgpbg11.asc (Beginner's Guide) http://pluto.cc.umr.edu/~steve/Privacy_Page.html/Where_is_PGP.html http://www.netresponse.com/zldf http://bookweb.cwis.uci.edu:8042/Orders/ubipgp.html http://www.geopages.com/Athens/1802/pgpfaq.html http://www.pgp.net/pgp http://www.sydney.sterling.com:8080/~ggr/pgpmoose.html Beginner's Guide: send email to slutsky(a)lipschitz.sfasu.edu, subject: bg2pgp WHAT ARE SOME GOOD PGP BOOKS? Protect Your Privacy: A Guide for PGP Users by William Stallings Prentice Hall PTR ISBN 0-13-185596-4 US $19.95 This is a good technical manual for PGP for most users, and makes a better reference than the "official" documentation that comes with PGP. I recommend it highly. PGP: Pretty Good Privacy by Simson Garfinkel O'Reilly & Associates, Inc. ISBN 1-56592-098-8 US $24.95 E-Mail Security: How to Keep Your Electronic Mail Private "Covers PGP/PEM" by Bruce Schneier Wiley Publishing The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP PRivacy Software by André Bacard Peachpit Press ISBN 1-56609-171-3 US $24.95 800-283-9444 or 510-548-4393 This is an interesting book on the sociology and politics of privacy in the computer age as well as a practical manual on using PGP. Must reading for all members of Congress, presidential staff, members of Parliament, and ordinary citizens who would like to take reasonable steps to protect themselves from some forms of crime that have been made easy by technology. THE OFFICIAL PGP USER'S GUIDE by Philip R. Zimmerman MIT Press April 1995 - 216 pp. - paper - US $14.95 - ISBN 0-262-74017-6 ZIMPP Standard PGP documentation neatly typeset and bound. PGP SOURCE CODE AND INTERNALS by Philip R. Zimmerman April 1995 - 804 pp. - US $55.00 - 0-262-24039-4 ZIMPH This is a handy printed reference with commented source code for PGP 2.6.2 with great educational value. This is a great way to study some of the computer science and information theory behind the world's best email privacy tool without having either a computer or reams of printouts handy. Recommended reading on long airline flights for serious students of computer science and computer security. Ordering information for the last two books: Call US Toll Free 1-800-356-0343 or 617-625-8569. Cite code 5CSC and number 661. Allow 4-6 weeks for delivery within North America. Allow 8-12 weeks for delivery outside of North America. How to Use PGP, 61 pages, (Pub #121) from the Superior Broadcasting Company, Box 1533-N, Oil City, PA 16301, phone: (814) 678-8801 (about US $10-$13). WHERE CAN I GET PGP LANGUAGE MODULES? These are suitable for most PGP versions. http://www.ifi.uio.no/~staalesc/PGP/language.html ftp://ftp.ifi.uio.no/pub/pgp/doc/ German ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha ftp://ftp.informatik.uni-hamburg.de:/pub/virus/crypt/pgp/language/pgp_german.asc ftp://ftp.leo.org/pub/comp/os/os2/crypt/pgp262i-german.zip Italian ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Norwegian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_norwegian.tar.gz ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26i_norwegian.zip Romanian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_romanian.tar.gz ftp://ftp.encomix.es/pub/pgp/lang/pgp-romanian.zip http://www.info.polymtl.ca/zuse/tavi/www/archive/ro_2.6.2.zip http://www.info.polymtl.ca/zuse/tavi/www/archive/language.txt Russian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz ftp://ftp.encomix.es/pub/pgp/lang/pgp262i-spanish.zip Swedish ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt IS PGP MORALLY RIGHT? PGP itself is morally neutral. What you do with it is not. Protecting privacy, prevention of criminal theft, and taking due diligence to protect certain business information (like credit card numbers, customer lists, etc.) are good uses for PGP. Concealing criminal or other immoral activity is wrong. You can fool the police some of the time, but you can't fool God. IS PGP LEGAL? Pretty Good Privacy is legal if you follow these rules: Don't export PGP from the USA except to Canada, or from Canada except to the USA, without a license. If you are in the USA, use either Viacrypt PGP (licensed for commercial use) or MIT PGP using RSAREF (limited to personal, noncommercial use). Outside of the USA, where RSA is not patented, you may prefer to use a version of PGP (2.6.i) that doesn't use RSAREF to avoid the restrictions of that license. If you are in a country where the IDEA cipher patent holds in software (including the USA, Canada, and some countries in Europe), make sure you are licensed to use the IDEA cipher commercially before using PGP commercially. (No separate license is required to use the freeware PGP for personal, noncommercial use). For direct IDEA licensing, contact Ascom Systec. Ascom Systec has taken over the distribution of IDEA licenses effective April 1, 1995. Erhard Widmer is the person responsible for the sales aspects, and Peter Hartmann is responsible for the technical aspects. They can be reached as follows: Erhard Widmer, Ascom Systec AG, Dep't. CMVV Phone +41 64 56 59 83 Peter Hartmann, Ascom Systec AG, Dep't. CMN Phone +41 64 56 59 45 Fax: +41 64 56 59 90 e-mail: IDEA(a)ascom.ch Mail address: Gewerbepark, CH-5506 Maegenwil (Switzerland) Don't sell PGP based on Philip Zimmermann's source code in North America unless you are reselling for Viacrypt (because they have an exclusive marketing agreement on Philip Zimmermann's copyrighted code). (Selling shareware/freeware disks or connect time is OK). This restriction might be lifted with PGP 3.0, since it is a complete rewrite by Colin Plumb. Distribution and use restrictions on that version are still to be determined. If you modify PGP (other than porting it to another platform or adapting it to another compiler), don't call it PGP (TM) or Pretty Good Privacy (TM) without Philip Zimmermann's permission. WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS? Philip Zimmermann is under investigation for alleged violation of export regulations, with a grand jury hearing evidence. There is speculation that the Feds are trying to make an example of Phil through prolonged and expensive legal proceedings, thus reaping a reward of Fear, Uncertainty, and Doubt to discourage development and use of strong crypto in the USA. Even though people in this country are considered innocent until proven guilty, there is a problem with the system in that it can take lots of money for innocent folks to defend themselves. Because of the broad implications for freedom, privacy, and the First Amendment of the U. S. Constitution in this case, I implore all of you who can to help out with Phil's rather significant legal and travel expenses involved in his defense. Phil is a nice guy with a wife and two children to support, and he has done a great deal in his PGP social activism to help all of us. To send a check or money order by mail, make it payable, NOT to Phil Zimmermann, but to "Philip L. Dubois, Attorney Trust Account." Mail the check or money order to the following address: Philip Dubois 2305 Broadway Boulder, CO USA 80304 (Phone #: 303-444-3885) To send a wire transfer, your bank will need the following information: Bank: VectraBank Routing #: 107004365 Account #: 0113830 Account Name: "Philip L. Dubois, Attorney Trust Account" To contribute using your credit card (secured with PGP), simply compose a message in plain ASCII text giving the following: the recipient ("Philip L. Dubois, Attorney Trust Account"); the bank name of your VISA or MasterCard; the name which appears on it (yours, hopefully :-)); a telephone number at which you can be reached in case of problems; the card number; date of expiry; and, most important, the amount you wish to donate. (Make this last item as large as possible.) Then use PGP to encrypt and ASCII-armor the message using Phil Dubois's public key, distributed with PGP 2.6.2. E-mail the output file to Phil Dubois (dubois(a)csn.org) Please be sure to use a "Subject:" line reading something like "Phil Zimmermann Defense Fund" so he'll know to decrypt it right away. WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP? http://www.ifi.uio.no/~staalesc/AutoPGP.html http://www.dayton.net/~cwgeib ftp://oak.oakland.edu/SimTel/msdos/security/apgp22b.zip ftp://oak.oakland.edu/SimTel/win3/security/pgpw40.zip http://alpha.netaccess.on.ca/~spowell/crypto/pwf31.zip ftp://ftp.netcom.com/pub/dc/dcosenza/pgpw40.zip ftp://Sable.ox.ac.uk/pub ftp://ftp.firstnet.net/pub/windows/winpgp/pgpw40.zip <WinPGP's home site> http://www.firstnet.net/~cwgeib/welcom.html ftp://ftp.netcom.com/pub/ec/ecarp/pgpwind.zip http://www.eskimo.com/~joelm (Private Idaho) ftp://ftp.eskimo.com/~joelm http://www.xs4all.nl/~paulwag/security.htm http://www.LCS.com/winpgp.html ftp://mirrors.aol.com/mir01/circa/pub/pc/win3/util/pwf31.zip http://netaccess.on.ca/~rbarclay/index.html http://netaccess.on.ca/~rbarclay/pgp.html ftp://ftp.leo.org/pub/comp/os/os2/crypt/gcppgp10.zip ftp://ftp.leo.org/pub/comp/os/os2/crypt/pmpgp.zip http://iquest.com/~aegisrcs Compuserve: Library 3, European Forum. Library 6, NCSA Forum PCWorld Online Forum. WUGNET Forum. WinShare Forum See also the BBS list for PGP, above. WHERE CAN I GET THE MACPGP KIT? ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/MacPGPkit1.6.sit OTHER MAC ADD-ONS ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/ChainMail.0.7.sit ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/Eudora->PGP Scripts1.5.sit ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/mac/AppleScripts WHERE IS THE PGP 3.0 API DRAFT? The (prelim. draft) PGP 3.0 API is at: ftp://ftp.netcom.com/pub/dd/ddt/crypto/crypto_info/950212 pgp3spec.txt All comments on it for the PGP 3.0 API Team should be sent to: <pgp(a)lsd.com> WHAT OTHER FILE ENCRYPTION (DOS, MAC) TOOLS ARE THERE? PGP can do conventional encryption only of a file (-c) option, but you might want to investigate some of the other alternatives if you do this a lot. Alternatives include Quicrypt and Atbash2 for DOS, DLOCK for DOS & UNIX, Curve Encrypt (for the Mac), HPACK (many platforms), and a few others. Quicrypt is interesting in that it comes in two flavors: shareware exportable and registered secure. Atbash2 is interesting in that it generates ciphertext that can be read over the telephone or sent by Morse code. DLOCK is a no-frills strong encryption program with complete source code. Curve Encrypt has certain user-friendliness advantages. HPACK is an archiver (like ZIP or ARC), but with strong encryption. A couple of starting points for your search are: ftp://ftp.csn.net/mpj/qcrypt10.zip ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/file/ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/ (see ftp://ftp.csn.net/mpj/README for the ???????) ftp://ftp.miyako.dorm.duke.edu/mpj/crypto/file/ HOW DO I SECURELY DELETE FILES (DOS)? If you have the Norton Utilities, Norton WipeInfo is pretty good. I use DELETE.EXE in del110.zip, which is really good at deleting existing files, but doesn't wipe "unused" space. ftp://ftp.csn.net/mpj/public/del120.zip ftp://ftp.demon.co.uk/pub/ibmpc/security/realdeal.zip WHAT DO I DO ABOUT THE PASS PHRASE IN MY WINDOWS SWAP FILE? The nature of Windows is that it can swap any memory to disk at any time, meaning that all kinds of interesting things could end up in your swap file. ftp://ftp.firstnet.net/pub/windows/winpgp/wswipe.zip WHAT EVER HAPPENED TO PGPfone(tm)? PGPfone is in beta test for Macintosh users. A Windows 95 version is being developed. http://web.mit.edu/network/pgpfone ftp://net-dist.mit.edu/pub/PGPfone/README ftp.hacktic.nl/pub/pgp/pgpfone WHERE DO I GET NAUTILUS? Bill Dorsey, Pat Mullarky, and Paul Rubin have come out with a program called Nautilus that enables you to engage in secure voice conversations between people with multimedia PCs and modems capable of at least 7200 bps (but 14.4 kbps is better). See ftp://ripem.msu.edu/pub/crypt/GETTING_ACCESS ftp://ripem.msu.edu/pub/crypt/other/nautilus-phone-0.9.2-source.tar.gz ftp://ftp.csn.net/mpj/README ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/voice/naut092.zip ftp://ftp.netcom.com/pub/mp/mpj/README ftp://ftp.netcom.com/pub/mp/mpj/I_will_not_export/crypto_???????/voice/naut… ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS ftp://miyako.dorm.duke.edu/mpj/crypto/voice/naut092.zip ftp://ftp.dsi.unimi.it/pub/security/crypt/cypherpunks/nautilus The Colorado Catacombs BBS 303-772-1062 ftp://ftp.ox.ac.uk/pub/crypto/misc HOW DO I ENCRYPT MY DISK ON-THE-FLY? Rather than manually encrypting and decrypting files, it is sometimes easier (and therefore more secure, because you are more likely to use it) to use a utility that encrypts or decrypts files on the fly as you use them in your favorite applications. This also allows you to automatically encrypt temporary files generated by your applications if they are on the encrypted volume. Secure File System (SFS) is a DOS device driver that encrypts an entire partition on the fly using SHA in feedback mode. Secure Drive also encrypts an entire DOS partition, using IDEA, which is patented. Secure Device is a DOS device driver that encrypts a virtual, file-hosted volume with IDEA. Cryptographic File System (CFS) is a Unix device driver that uses DES. http://www.cs.auckland.ac.nz/~pgut01/sfs.html ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/disk/ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/disk/ (see ftp://ftp.csn.net/mpj/README for the ???????) ftp://miyako.dorm.duke.edu/mpj/crypto/disk/ ftp://ftp.nic.surfnet.nl/surfnet/net-security/encryption/disk/ ftp://ftp.demon.co.uk/pub/ibmpc/secdev/secdev14.arj EMAIL/PGP LINKS http://cag-www.lcs.mit.edu/mailcrypt/ (EMACS LISP) WHERE IS PGP'S COMPETITION? RIPEM is the second most popular freeware email encryption package. I like PGP better for lots of reasons, but if for some reason you want to check or generate a PEM signature, RIPEM is available at ripem.msu.edu. There is also an exportable RIPEM/SIG. ftp://ripem.msu.edu/pub/GETTING_ACCESS HOW DO I PUBLISH MY PGP PUBLIC KEY? Send mail to one of these addresses with the single word "help" in the subject line to find out how to use them. These servers sychronize keys with each other. pgp-public-keys(a)keys.pgp.net pgp-public-keys(a)keys.de.pgp.net pgp-public-keys(a)keys.no.pgp.net pgp-public-keys(a)keys.uk.pgp.net pgp-public-keys(a)keys.us.pgp.net pgp-public-keys(a)burn.ucsd.edu pgp-public-keys(a)pgp.cc.gatech.edu pgp-public-keys(a)goliat.upc.es pgp-public-keys(a)demon.co.uk pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)ext221.sra.co.jp pgp-public-keys(a)fbihh.informatik.uni-hamburg.de pgp-public-keys(a)jpunix.com pgp-public-keys(a)kiae.su pgp-public-keys(a)kr.com pgp-public-keys(a)kram.org pgp-public-keys(a)kub.nl pgp-public-keys(a)nexus.hpl.hp.com pgp-public-keys(a)pgp.ai.mit.edu pgp-public-keys(a)pgp.barclays.co.uk pgp-public-keys(a)gondolin.org pgp-public-keys(a)pgp.dhp.com pgp-public-keys(a)pgp.hpl.hp.com pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.kr.com pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ox.ac.uk pgp-public-keys(a)pgp.pipex.net pgp-public-keys(a)srce.hr pgp-public-keys(a)sw.oz.au pgp-public-keys(a)uit.no pgp-public-keys(a)vorpal.com pgp-public-keys(a)nic.surfnet.nl WWW interface to the key servers: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html http://www-lsi.upc.es/~alvar/pks/pks-toplev.html For US $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ PGP public keys which are stored on SLED's Four11 Key Server are now retrievable by fingering UserEmailAddress(a)publickey.com. Example: My e-mail addresses is mpj(a)csn.org finger mpj@csn.org@publickey.com My key (mpj8) is at Four11.com, at ftp://ftp.csn.net/mpj/mpj8.asc, on the key servers, on my BBS, and available by finger. WHICH FAQ IS THE OFFICIAL ONE? The main alt.security.pgp FAQ is published by Jeff A. Licquia <jalicqui(a)prairienet.org> and is available at ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt This shorter FAQ just covers a few of the most frequent questions and points you to the main FAQ for more answers. This file is ftp://ftp.csn.net/mpj/getpgp.asc, There are some other periodic FAQ-related postings, too, like the miniFAQ posted by Andre Bacard, which is more about promoting the use of PGP than where to get it or how to use it. FAQs are also posted to news.answers and alt.answers, and archived at rtfm.mit.edu. CAN I COPY AND REDISTRIBUTE THIS FAQ? Permission is granted to distribute unmodified copies of this FAQ. This information is also in http://www.csn.net/~mpj, which you may link to or adapt for use at your own web sites. ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMICOWPX0zg8FAL9FAQEO1AQAvLSMXX9J/nZ/4Wc/TTS9a60e+G5vbvTR KU2+KixGhKfHkH5eb9mHwUtuDTiPJSRvnyfx0EOrgs7b5cC8hZsxKnlyfNnsvEG+ fdxGxy1h90L69CUVFD5CGvIbTlTo7a1xT5tYj/knqTO0OH4WOZVVh60uhGpuzevb 0+99R2mUJoA= =H2Bc -----END PGP SIGNATURE-----

1 0

Re: mental cryptography
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

On Sat, 14 Oct 1995, Nathan Loofbourrow wrote: > Boy, and isn't it fun to receive all the bounce messages from every > post to cypherpunks? Part of the problem is his provider who is sending the bounce messages to the list and not the list owner (as shown in the Sender Header).

1 0

Macintosh [and perhaps other OS] Security Alert
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A number of months ago, I discovered that various Macintosh "unused diskspace" wipe utilities (Norton, Burn) fail to wipe the unused slackspace at the end of the last block allocated to a file. This leaves NumberOfFiles*512Bytes/2 = several kB of recoverable data on your average drive. I had assumed that this data was left there by other files previously using the same block. This would certainly be a problem. But I discovered that matters are much worse. The Macintosh file system will always write an entire block. The extra data can therefore not come from an old file. It comes from the memory space immediately following the data to be written. This is a very serious security risk. Your decrypted secret key, ANYTHING in memory might be written to disk and remain there, unerasable by disk wipe utilities. I would appreciate some comments. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMICWfCoZzwIn1bdtAQFDyAF/QLI0RJQ/E2+wktITd+3SBCCB8L24Y/vV rq0hPikG9pELYcC/bMwXvD+utoW/E8NQ =IHqi -----END PGP SIGNATURE-----

1 0

Re: Anguilla Cypherpunks Meeting
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9510131114.A70910-0100000(a)aix2.uottawa.ca>, s1018954(a)aix2.uottawa.ca wrote: > Really? I thought except for incomes taxes, US laws only apply in American > territory as opposed to applying to American people wherever they are (as > I heard Germany's does). US laws not only apply to US citizen abroad, they apply to non-US citizens living abroad. See Noriega. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMICZOioZzwIn1bdtAQEUoAGA3Q3nk9e3HA5l1jzG/DyJ8MjcZ+jfx/v3 4UM43jJZwTWFIZ7DLw9O44wvFHVMlj6K =n1+8 -----END PGP SIGNATURE-----

1 0

Re: applications
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <m0t3rzZ-000K7TC(a)mail.infinet.com>, zoetrope(a)infinet.com (cYberpUnc) wrote: > I know this isnt what you guys generally talk about but I was curious. > Off the top of your head do you know of any sites where I can get kracking > apps for macs? Any information would be greatly appreciated. I suggest <news:alt.binaries.warez.mac>. Get C&N (Cracks and Numbers). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMICaDioZzwIn1bdtAQFASQF/ausHvyFqDCdGQDwiY2zjGxhJ2DpHYb86 yGjpgvrqjT1YE98N2bTeS/Ejm1pxrXVl =4wZO -----END PGP SIGNATURE-----

1 0

Re: Yes, indeed the PA law is for real!
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510141649.AA20952(a)cfdevx1.lehman.com>, rfb(a)lehman.com (Rick Busdiecker) wrote: > I'm guessing that you're referring to this part of the law: > > (1) [makes or possesses any instrument, apparatus, equipment or] > makes, distributes, possesses, uses or assembles an unlawful > telecommunication device or modifies, alters, programs or reprograms > a telecommunication device designed, adapted or which can be used: Own a non-approved computer (not using Government approved software) go to jail. Historic comment: I predicted this on this very list ages ago. Even mentioned "You read it here first". - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMICbwyoZzwIn1bdtAQEaMgGAs3ZFT2TmWbHxQg1xtkJKPUri4TBlpjbx 73dwbNh1TC0Ls+QG/q1xDStqc1rvMFs1 =BWyG -----END PGP SIGNATURE-----

1 0