December 2003 - cypherpunks-legacy

Re: HTTP redirectors
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> However, running this kind of local proxy or a general chaining > proxy does require root access. Most systems will not let you > create a low-numbered socket unless you are root. So this is not > something which people will be able to do from their user > accounts. Normally a URL can specify an alternate port as well (of course). A common one is http://site.org:8080/dir/file.html... This gets around setting up the proxy without a privileged account. The only web browser I'm familiar with (OmniWeb for NeXTSTEP) also allows you to specify the port number for the proxy. I was under the impression that all browsers supported alternate port numbers for proxies since they are commonly used for URLs... Do Mosiac and Netscape allow specifying the port for proxy servers? andrew

2 1

Win NT crypto?
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Does anyone know if any of the 'standard' CP tools (remailers, etc) would run on a Windows NT machine (server edition 3.5)? A couple friends and I are under serious contemplation of setting up an ISP in a town of 100K+, and if it's possible, I'd like to put an anon remailer on it. Thanks... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)fohnix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Re: anon-HTTP server w/o root access
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- someone writes: $ an anon-http proxy server would probably consume much more in $ the way of network resources than a remailer, which will $ likely lead to many being shutdown once discovered by the sysadmins That might be somewhat less true on a commercial provider than on an educational or corporate provider, but in any case a WWW anon-server would be seen as a much larger potential security hole than a remailer. A couple of months ago a "friendly" outsider gained unauthorized access to user files here via our Web server, and reported it to the sysadmins. I would have been mighty nervous if I'd been offering anon WWW access to the world. - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvd5y2f7YYibNzjpAQFBlwP/dp2gm/Ek3HOZ89SR0x/XpEXVTeHiHTzy 8QddAR35OrONJBUfZO81NyNXfthSmQEN6+d2GfQ7pm2ZupEpHlunWhokYrd6dnmo 1Cbkzi3/eCt0MsH5cTYKZ/JQ0kPRjEUpJdRaRjAfQf18VMRPpXM8D9SzVp/bwRVs iBiZKFfGkqI= =7jHV - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvd7ACoZzwIn1bdtAQHAiAF6AsXil0bJAgMJpyTJgo7cYW51+Ywz2uIR /bIM2Vew7GoE/yUXoiJkjUzLh35/hRtk =2jos -----END PGP SIGNATURE-----

2 1

GUI: PGP vs novices
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 'Punks, It's time for dave's quarterly "why are we here" post: Well, the good news is that people in "the mainstream" are beginning to notice PGP and discuss the need for its existence. The bad news is that PGP is not really ready for them. As a system administrator for many novice users (hundreds at a time in the past), I can say with humble authority that PGP, no matter how trivially simple it may seem to us, is well beyond the ken of most users (I won't attempt to put a %age on them, let's just say it's well into the 90's). And it's not like no-one's noticing either: - From a pure cost:benefit ratio, PGP is not yet a useful tool for most users. I hate to frame it in such "'mersh" terms when the flow on this list is largely fascinating crypto-math or splendidly colorful insults, but let's admit our dirty little secret: PGP won't be widespread, people won't really appreciate all the good crypto work being done here and repressive government agencies and paranoid lawmakers will continue to whittle away at electronic privacy rights until the day that PGP becomes a widely-used, viable commercial utility. All you ViaCrypt people just sit tight: I'll get to you below. :) I was particularly dis-Mayed by the initial reception that the Netscape folks received here. The Netscape/BofA posting I made recently obviously touched a nerve and well it should. I can certainly understand why Timothy would get CPO (completely pissed off) and want to take a vacation after some of the flotsam I saw drifting by here. As others have noted, some of your remarks were ill-considered and lacked tact. That doesn't make you bad people: I open mouth and insert foot now and then myself, but it's a good thing to consider next time an earnest startup working on a devilishly fasttrack schedule and trying to incorporate crypto comes online here. Let me take this opportunity to offer an olive branch to the Netscape people. Your first shot with SSL is "okay," and I'll do what little I can to help you find/implement/test something better (even if you never return my phone calls, Tom Paquin!). Now then, if you'll bear with me: - ------------------------------------------------- > From: stephen.mccluskey.(a)hammar.pp.se (Stephen Mccluskey ) > Newsgroups: alt.security.pgp > Subject: Re: I NUKED PGP. Why? This is why: [elided] > Message-ID: <9412160602073878(a)hammar.pp.se> [elided] > John Dulaney has received a bit of flak for his statement > that PGP is too complicated for the average user. Although I'm not an > average user, I'd have to agree. The average user in our department can > handle a word processor, do a bit with electronic mail, format a disk and > a few other rudimentary things in DOS, and that's about it. > If PGP is going to take off, it needs to consider their needs by > seamlessly and transparently connecting with both mailers and word > processers, so encrypting and sending a file would be no more complicated > than printing, faxing, or e-mailing the same file. [elided] Actually, what it needs to break down to is a system software extension (to use the Mac as an example) that adds a smart "Encrypt/Decrypt" button (with a "sign" option) to every appropriate document-editing window, since printing, faxing and/or email are ALSO pretty challenging-to-impossible to a vast number of novice users. I'm not trying to insult the novices out there at all (if anything I sympathize with their plight and spend huge chunks of my time explaining the rudiments to them over and over again), I'm just speaking from experience as a sysadmin, tech support manager and educator. - ------------------------------------------------- > From: trimble(a)beckman.uiuc.edu (Chris Trimble) > Newsgroups: alt.security.pgp > Subject: Re: I NUKED PGP. Why? This is why: [elided] > Message-ID: <3cmuhl$5vu(a)vixen.cso.uiuc.edu> [elided] > Not everyone in the world who might need/ > want to use PGP is a computer-savvy guy. This is something that I discussed > with the MacPGP developers some two years ago. I offered to rewrite it from > scratch, and was told not to because "there is a much better interface in > development and will be available soon". I still have yet to see any of > that. Me either. BTW, does anyone know what ever happened to Crunch's OOP version for the Mac circa 1993? > MacPGP is an example of a program that violates Apple's HIG up the wahzoo. This is an dramatic understatement, and considering that the MacOS and Windows versions are the most likely candidates for spreading the use of crypto among mainstream users and thus further widening the opening of the barn door referred to in the post about Newt Gingrinch, it's a case of near-criminal neglect on the part of the low-level and interface-level Cypherpunks. I have no problems (well almost none) with the MacPGP versions I've used, but friends/colleagues/students I've exposed it to are generally left dumbfounded. This significantly adds to the difficulty of explaining WHAT cryptography is, explaining WHY they need it and then trying to show them a simple tool for empowering themselves with it. I'd estimate that _maybe_ 10 of the roughly 250+ people I've spent quality time explaining PGP to are still using it. This is the lowest success-rate (measured in persistence of use) of any single piece of software I teach people how to use. This bodes not well for the future of electronic privacy and personal cryptography, especially when you factor in the minute percentage of those people who'll actually cast an informed vote on anything crypto-related in the next election. Not well at all. Time is on the side of the NSA, unfortunately. ViaCrypt has kindly offered to send me a beta of their upcoming Mac version with enhanced AppleEvents support. This promises to open up some scripting capabilities not present in other earlier versions. I'm hopeful that, even if it doesn't differ significantly from MacPGP 2.6ui v1.2, the ViaCrypt app and the tech support that ViaCrypt provides will go a long way toward getting some of my users/clients/students using it, and I'm happy to pass the business along to them in light of their efforts. The Cypherpunks should really launch a new list oriented toward novices with basic questions. It could be a Web page with a question form, or even an email address for the Web-challenged (I may do it, but I welcome any offers to help). As an incentive to Cypherpunks, their friends and colleagues and members of the general public, I'm hereby offering to spend some time answering questions for novice users at either: <crypto-questions(a)lsd.com> or <pgp-questions(a)lsd.com>. Feel free to spread the word on this FREE (but limited by my time) service I'm offering. When the volume becomes too heavy, I'll ask you all to participate as well by asking you to identify what platform you use and what areas you're particularly savvy in ("Bo Knows Remailers."). Think of it as cypherpunk pro bono work: heck if _lawyers_ can do it, then altruistic 'punks can too, right? Those two addresses are NOW up-and-running, BTW. Both map to the same tech supt account, so circulate the one you think sounds most appropriate. > [MacPGP] completely locks your machine without any kind of dialog box when > you are decrypting or encrypting, the menus aren't particularly related to > the items under them, etc etc. Indeed, MacPGP is the single most un-Maclike app I run regularly, without exception. I've been using it for three years, and while there has been progress, it's been extremely limited, mostly in fixing the most egregious GUI violations and keeping up-to-date with improvements in PGP source code. So IMHO the Cypherpunks, as one of the formost proponents of this technology, are basically shooting themselves in both left feet by not immediately and actively setting aside their wonderful projects to come up with more uncrackable crypto-algorithms (I'm not saying to STOP!) and focus for a few solid months collaborating on two extremely workable, fabulously easy implementations of the most basic functions of PGP for Windows and Mac boxes that any novice user can "plug in" and run alongside the software they use daily (word processors, email apps, even spreadsheets). In addition to the system extension idea above, drag-n-drop apps for Mac desktops that people can plop a WP file on to encrypt/decrypt/sign it and the analog for Windows users should be a SUPER-HIGH PRIORITY starting yesterday. Is it beyond the scope of possibilities to actually get the most code-wise capable people here to stop flaming each other and name-calling and work together for a while? How much bigger a barrel must we be staring down before there's some significant togetherness resulting in visible software? > If the "cypherpunks" really want to see a world of free encryption, then > they should start putting more effort into making that encryption more > comprehensible to the ordinary user. Right now, PGP is a program that isn't, > and is essentially only usable to those who are computer-savvy. Let me cite a small example: a few minutes ago, I let a close personal friend sit down at my workstation to telnet to her email account, and she proceded, while my back was turned for *just a moment*, to close *every dang window* in *all 14 processes* I had running (including some text and a script I'd been editing - grrr) so that she could (get this...) "clean up the screen." I explained in the most non-emotional, non-accusatory terms what she'd just done (without mentioning the hours of work she'd cost me by not saving certain things). Her response mechanism was to tear up and begin to (almost) cry. No, it has nothing to do with the Moon, and yes, this normally a very competent person (errr, computing matters excluded, need I mention?). Anyway, it was my own dang fault, wasn't it? Of course it was: how could _she_ know that there's an easy mechanism for _hiding_ all the windows in the bg processes? That's far too hidden a feature. Sure, there's a "Hide Others" menu item under an iconic menu (cute but cryptic), but what does "Others" refer to? Everyone else in the room who might look over your shoulder? Think about it. For that matter, what the HECK is a "console" window, or a "verbose" menu command? And this is on a friggin' MACINTOSH! We're not even talking Windows here, lads, much less X Windows... or even >gasp< DOS! ;) Anyway, this is just an object lesson on how exCRUciatingly simple crypto is going to have to become. Too bad we can't get it all running by the end of the day, because in half an hour I have to attempt to teach that same friend to use PGP... ...wish me luck. dave _____________________________________________________________ "Civil Liberty Through Easy Cryptography." (ibi, nuntium!) -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLveIhqHBOF9KrwDlAQG4YwQAwqbqD6Qx291kAzSmtJRaReUrIV7/X1WC Hp2j2ABshWe35TFwdc1n8KhShUYljnMCEWvNvTYOzTCFpdLLAf5lOc0tSH1RVYGH kWtoeBEn3ciqBHXBddeQazS0SRm9lAcd4oX3Zwt4wXokE2hnaF3KGamJI2sVZ+Io b3RIBVNJOGI= =9Qwl -----END PGP SIGNATURE-----

3 3

No privacy with DigiCash
by Hal 17 Dec '03

17 Dec '03

One of the reasons we want http redirectors is so we could buy things anonymously. There is not much point in anonymous digital cash when your web connections advertise who you are. But, the current ecash implementation from DigiCash doesn't allow this to work! When you buy something, the vendor has to know your machine name because he wants to connect back to your ecash wallet process. So even if you did connect via a redirector, your anonymity would be destroyed (or at least badly hurt) when you tell it your machine name so it can connect to you. This is a really bad way of doing it IMO because it seems to defeat one of the big selling points of DigiCash. Is there something I am overlooking, some way to buy things privately with DigiCash? Hal

3 3

Kiwi cypherpunks & other things
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

All, I am going on holiday for 3 weeks so will be unsubing from the list for a while. Can you email me directly about kiwi cpunks? and other stuff. A listserv @ cybernet would be a good thing. We could have our own NZ kiwi cypherpunks mailing list! Oh, what we would talk about! :) Oh, Thanks to all who helped me with the 2048 bit keys. I thought it was the 15-dec-94! Anyway I changed the source a bit so now I can generate 16384 bit keys. On the other hand trying to gen a 2048 bit key with this modified code just failed so maybe I`ll have to wait!!! (shiiit!) I cant set the clock on our machines. T

1 0

FW: Opportunity: Software Engineer with TIA Development Team
by Johnathan Corgan 17 Dec '03

17 Dec '03

Just an FYI for anyone out there: On Tue, 20 Dec 1994 14:47:34 -0700 Andrew Currie wrote: >Cyberspace Development, Inc. (CSD) has an immediate opening >for an experienced C/C++, UNIX, TCP/IP software developer to >join our TIA product development team. Responsibilities will >include design & development of new features, customization, >optimization, porting to new platforms, and maintenance. >This developer will also be involved in future CSD products >and online services beyond TIA. > >TIA, or The Internet Adapter (tm), is a commercial software product >sold over the Internet that emulates a SLIP (and soon PPP) connection >on a standard Internet shell account. (For complete info on TIA >and more info on CSD please visit our site at http://marketplace.com/ >or send email to tia-info(a)marketplace.com.) > >Technical Skill Requirements >---------------------------- >* Excellent C and C++ programming skills >* Experience with TCP/IP programming >* Experience with serial communications programming >* Detailed knowledge of PPP >* Development experience with several UNIX environments >* Deep knowledge, wide experience, and interest in Internet technology > >Other Requirements >------------------ >* Strong commitment to customer satisfaction >* Flexible & adaptable; with a proven ability to learn quickly >* Willing to take responsibility & "ownership" of a problem till solved >* Self-starter with strong work ethics (dependable) >* Team Player - enjoy working in concert w/sales, marketing & tech support >* Provide your own office with phone, machine, & Net connection > >Definite Plus: >--------------- >* Already aware of, understand, (and use) TIA daily >* Located in or near Boulder, CO or Seattle, WA >* Previous experience with commercial product development >* Experience in the online services industry or another start-up >* SQL and relational or object-oriented DBMS experience >* PERL, csh, CGI, or HTML scripting experience >* Add'l experience with one or more: Mac, Windows, DOS, VMS development > >Compensation >------------ >* Negotiable depending on education, work experience, and "fit". >* Developer will start as a contractor so we both have a "dating period". >* We are open to profit-sharing as part of the compensation package > >Schedule >-------- >* Start immediately (or by 1/31/95 at the latest) > >If this opportunity sounds like a match with your skills & interests >then please send the following info in ASCII format: > >o Detailed response to each bullet item above (with examples please) >o Current resume >o 3 recent references relevant to both technical skills & work style >o The compensation you suggest >o Earliest date you could start >o Any questions/issues you have > >as soon as possible to: Opportunity(a)MarketPlace.com > >Thank you for your time and attention. Please forward this post to >other relevant mailing lists, newsgroups, or folks who may be interested. > >======================================================================== >Cyberspace Development, Inc. Makers of TIA - The Internet Adapter (tm) >======================================================================== > > > ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan =======================================================================

1 0

Intel to recall Pentiums
by hacsc218＠huey.csun.edu 17 Dec '03

17 Dec '03

Silicon Valley, CA- Intel Corporation announced today their plans to exchange up to several million defective Pentium microprocessors. The chips, widely used in personal computers, have a flaw which causes them to make calculating errors. Although the problem affects only certain types of applications, Pentium owners have demanded a recall. Asked what the company intended to do with the returned chips, a high-ranking Intel official, speaking on condition of anonymity, would say only, "let's just say we found a good home for them." On an unrelated note, the National Security Agency today announced plans for a major expansion of their Fort Meade headquarters... Mike

1 0

International Sports Book
by jpp＠markv.com 17 Dec '03

17 Dec '03

"Bag Your Bookie..." begins the add for "the world's largest legalized International Sports Book". With the optional ATM card, you can access your winnings within 48 hours of the event, at any ATM. Another example of the strength of "speed bumps" on the internet. Can the Internet Casino be far behind? Does anyone want to pitch digital cash to these folks? Does anyone want to make some bucks setting these folks up on the net? (How big do you think the market is for a internet sports book?) For further information you can "Enroll right now! Call 1-809-462-2279 and talk to one of our sports agents..." 24/7 I assume. j' P.S. It would cost me (US dollars) 1.41(connect charge) + 2.50(calling card) for the first minute, and 0.97 for each additional minute for me to call these folks (located in Saint John's Antillees (sp!?)) from here in Encino, California at 1940 monday via the MCI network.

1 0

Cryptographic filesystem for Linux?
by Jason Burrell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is there an encrypted filesystem for Linux out there? I'm speaking of something like Secure File System(DOS), but for Linux. The kernel in question is 1.1.59, soon to be upgraded to a later version. IDE drive, ex2fs formatted file system. Regards. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvfY9SoZzwIn1bdtAQHZFAGA3n8SRWBHKm74hkZjm1hFuZ1EFzcXiD78 lRYe4j/RHaxORSM3tHjC/lrt3v9xTF8a =KAWT -----END PGP SIGNATURE-----

5 4

Re: GUI: PGP vs novices
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Jeff Licquia writes: And yes, you're forgiven for posting private E-mail. :-) Again, not a flame, just a warning to be more careful. I really didn't mind in this case; however, you might be likely to find someone who would be in others. >>Just a small nit, but it appears that you're running something >>Windows-compatible on your desk (the DOS box and all that). Are you aware >>of the good Windows tools for PGP? The particular one I use (PGPClip by >>Mike Meyer) uses the clipboard, and is very nice and simple. > >Exactly my point Jeff. Thank you for justifying what I said....**WINK**, >**GRIN**. >In order to even use PGPClip, it involves something OUTSIDE the mail >application. (Although, it does sound intriguing to me.) Anyway, this is yet >another example of the user needing to be fully conscious that they are >signing or encrypting. It should be second nature. In order for it to become >second nature, it MUST be included in the design of the mail package. (Or News >reader, or FTP software, whatever.) > >Third party utilities make a piece of software harder to use. That's a given. Granted. However, I'm unfortunately not a developer for a mail package, which means I can only offer you a stopgap. However, since writing you, I did remember another resource. There's a commercial mailer called ZMail which is being talked about in alt.security.pgp. It's supposedly extensible, and Guy Berliner has written scripts for it which put an "Encrypt" and "Decrypt" button on his mailer's toolbar. Noticing you're from Spry, however, I may be encouraging you to use a competitor's package. Perhaps you could wield some influence to get the Internet-in-a-Box developers to integrate PGP into their mailer? >>Not a flame, or even a spark. Just wanting to make life easier for crypto >>enthusiasts. > >Didn't see any sparks at all, Jeff. I am interested in PGPClip (at least to >look at) does anyone have an FTP site pointer where I could find it? Unfortuantely, no. I got it directly from Mike Meyer. I can send you a copy via mail if you're interested. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLviTRLnwkw8DU+OFAQGoKAP/ZgNQnrPumarAbM8YJ3bsbnByaMmnjoUw 8UD6xsmZQ1ldnq5acjECEyfpIOKNY9cpwQR/SWunDbdiiTaiuNaCwMgDTeodsuNh YhBxFdCJ1mgXVsPevrmB9Q2SjZ/VXW/Zc43qlnzrsZSS+Xya7Xu+vQkTwLD5jyHb aLrowvU86OM= =d+cZ -----END PGP SIGNATURE-----

1 0

Remailer list needed
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Does anyone have a current listing of all the remailers? If so could you please send it to me as I would like to put it up on the auto-responder. Thanks, Sam ============================================================================== We love your adherence to democratic principles. - George Bush speaking to Ferdinand Marcos, June 1981 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvfooMlnXxBRSgfNAQGLlQf/TzjZCzrZhMYWgs7XqGeV9+35XXmrjy+f jqVseykiY3n3iEVDALIJobRCPATS962N1k2EinVHea0dKt+F6NA4xsrGStFdoneT bVeoPwSgXGqghVyy88gRwiSHHFincIztHnV4A/r59B/Nz/4hawmYD0vo9SZeHhrv ruBhWSJH6Cw/4Xh+17PgreLfpLCILFF0EFmXiiXrZ5dSsQZJ2aOD5LqN0TTbdxyN uakm0WPao1WTCx2yT+SiLLex55lTzHrgfvP/gINwDbUA1TUl64OEYGsjxyl7gHWw mCQrLFX0XxvAunB223aTBYNiGDyhy9P8BCN3yf95yYkxoCzq4pre6w== =YR7W -----END PGP SIGNATURE-----

1 0

Why I do what I do.
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I had a very telling conversation with my wife today. I was working on some procmail stuff while she thought I should be doing something else. After about a ten minute diatribe, she said "I don't know why you spend all that time messing around with that crypto stuff. What point does it have?" I responded, "Do you remember when you were a little girl, and you told your best friend a secret?" She replied with a testy "YES." "All I'm trying to do is make sure our children will be able to do the same, because with all the developments lately this may not be possible." After about ten minutes of silence, I got a very soft "I understand." The reason I have brought this conversation up is to make a point. You can have the best technology around, but if people can't relate to the general concepts involved as it relates to them, the war is lost. Sam ============================================================================== Television is the first truly democratic culture - the first culture available to everybody and entirely governed by what the people want. The most terrifying thing is what people do want. - Clive Barnes, in "New York Times", 1969 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvfouslnXxBRSgfNAQGMOgf9Er7usAgpi1H9PgTDQ6Sp6wvy3F9KL5Ly 8SxYO8wkIybIWcLTjuvC18MUQNe9dUTpLqSmjOsZqxIFvlkLna0HEwyO5d53Vta6 1yhLByTWoEiBuP2xfnSDWG19/uEivOGyZdlTjtJ0w6aquDlGepkGuWUFGEuhY0ee +45NjzSoCluQhn5elzA79bNvp4OkQMnbCdzk6ZXD6uO1w0iGXyEKRd8V9TXig5Ir 2QXbZDqayW2B6TJP7m+kyPgdJAOxJia3LLZe0icBW7Et9jdys0lolAIGfHHe9LLL dRMQnstSfxcvzDrhxEmZze/Jj9uP2S6WY3fKANO9IwwAugxrp92R8Q== =Iyk6 -----END PGP SIGNATURE-----

1 0

CFS for Linux
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- FYI: Forwarded message: > To: cypherpunks(a)toad.com > Subject: New version (1.2) of CFS now available > Date: Fri, 02 Dec 94 18:05:00 -0500 > From: Matt Blaze <mab(a)research.att.com> > > Source code for the latest version of CFS (release 1.2), the Cryptographic > File System, is now available upon request for research and experimental > use in the US and Canada. [...] > The software was developed under > SunOS and BSDI, and there are also unsupported user-contributed ports > available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really > can't promise to provide any technical support at all, beyond the > source code itself. We also maintain a mailing list for CFS users and > developers; subscription information is included with the source code. [...] > * Copyright (c) 1992, 1993, 1994 by AT&T. > * Permission to use, copy, and modify this software without fee > * is hereby granted, provided that this entire notice is included in > * all copies of any software which is or includes a copy or > * modification of this software and in all copies of the supporting > * documentation for such software. > * > * This software is subject to United States export controls. You may > * not export it, in whole or in part, or cause or allow such export, > * through act or omission, without prior authorization from the United > * States government and written permission from AT&T. In particular, > * you may not make any part of this software available for general or > * unrestricted distribution to others, nor may you disclose this software > * to persons other than citizens and permanent residents of the United > * States and Canada. > * > * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED > * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY > * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY > * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. > > If you would like a copy of the CFS source code, please send email to: > > cfs(a)research.att.com > > DO NOT REPLY DIRECTLY TO THE SENDER OF MESSAGE. You must include a > statement that you are in the US or Canada, are a citizen or legal > permanent resident of the US or Canada, and have read and understand > the license conditions stated above. Also include an email address in > a US or Canada-registered domain. The code will be sent to you via > email in a uuencoded compressed tarfile. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvfrsSoZzwIn1bdtAQHvcwGAn9qkYDbPDazGCM9Pg/8CDyTAgxm10Nj2 LB/Ek/NnzOTG8ywki0CEbF8B9ei2pxWH =bPdS -----END PGP SIGNATURE-----

1 0

Re: Remailer list needed
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- > Does anyone have a current listing of all the remailers? If so could you > please send it to me as I would like to put it up on the auto-responder. This seems to be the most popular question on c'punks lately. Raph posts his list periodically (weekly ?), but perhaps he should move it to every other day or daily. I think it would be worth posting more frequently here. I never tire of answering this one, though.... :) Anyway, the standard ways of accessing the latest list are: finger remailer-list(a)kiwi.cs.berkeley.edu http://www.cs.berkeley.edu/~raph/remailer-list.html I don't know of a way to get it automatically via mail. Since, short of Web access, Internet mail access is a necessary condition for using a remailer, I've been meaning to hack something together for Raph to handle this lowest- common-denominator means of access. So I think it would be great to see you set it up for autoreply, Sam, if you can hook it in to the source for regular updates. The list (from finger) as of just after I typed this follows: $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek" ; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Wed 21 Dec 94 2:00:01 PST remailer email address history latency uptime - - ----------------------------------------------------------------------- usura usura(a)replay.com **++*+*****# 6:59 99.99% alumni hal(a)alumni.caltech.edu *****+*****# 4:05 99.99% nately remailer(a)nately.ucsd.edu ++++.+++++++ 1:08:49 99.99% penet anon(a)anon.penet.fi ***+*+****** 32:46 99.99% portal hfinney(a)shell.portal.com ***********# 2:13 99.99% c2 remail(a)c2.org +-+++++-++ + 39:26 99.99% ideath remailer(a)ideath.goldenbear.com *++**+****** 9:35 99.98% bsu-cs nowhere(a)bsu-cs.bsu.edu *++********# 4:43 99.97% mix mixmaster(a)nately.ucsd.edu +++*.++++++- 1:17:13 99.97% vox remail(a)vox.xs4all.nl ..-----...-+ 15:20:51 99.99% q q(a)c2.org *-+--++- 3:46:16 99.88% rahul homer(a)rahul.net **** ****--# 27:49 99.67% soda remailer(a)csua.berkeley.edu .......... 9:50:58 99.61% desert remail(a)desert.xs4all.nl -------.-. 16:26:44 99.99% xs4all remailer(a)xs4all.nl **+ +**** # 7:14 99.41% flame tomaz(a)flame.sinet.org *+-++**+* +* 8:51 98.09% jpunix remailer(a)jpunix.com +-++**+* +# 8:25 97.96% rebma remailer(a)rebma.mn.org --___..-.--+ 21:50:14 90.15% extropia remail(a)extropia.wimsey.com -+ 5:00:06 17.69% -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvf9+Gf7YYibNzjpAQF+FwQAiqHC78uctkIG5vX+YF+H/EN8RodOLt6s EZjJW3BGbFitC20++3MfPJ2wUVFXLcNxUpXY1gEcbxMttNPaMayK4VrKNWFzZ7BT p1iKeb82Im+GYyL0EHvhtS8eDiyuPAyBSibQYjPppY/wfl5qW70FpxJ6hWc/4Avf twIJ5XYXFcU= =MO7e - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvf/oSoZzwIn1bdtAQE+jwF/RcW6oTb23KEqrgDUfVeB0p6KMPGaL6hF 5/I3/BqjqvAY0FrsHkdPTTvI9LDNjyOc =YjJG -----END PGP SIGNATURE-----

2 1

Making sure a program gets to the receiver intact
by an169306＠anon.penet.fi 17 Dec '03

17 Dec '03

How can I insure a program, once put on FTP sites stays untampered with? I have done the following, but I still find holes: 1: PGP signed each file with a seperate .sig file. 2: Made a MD5 list, using 2-3 seperate programs (making sure they agree), PGP signing the list, and asking friends to sign the list, leaving seperate .sigs in the directory. 3: Encrypting a copy of the MD5 list with a passphrase (if all keys are fragged, then in front of trusted witnesses, I can decrypt the key, show them that the MD5 list is authentic.) 4: PKZIPPING it using my AV key. (Yes, I am aware that this is a joke, but since I am a registered user, why not use it?) (Side note, if one uses PKZIP, please register it. I have seen so many unregistered copies of this, that it makes my eyes water.) The holes: 1: Someone hacking the keyservers, substituting a key for all the people who signed, and modifing the archive to show that. 2: Someone breaking into my apt, sticking a keyboard monitor on, getting my passphrase and key. Most of this is theoritical, as it is hard to hack _all_ keyservers to nuke my PGP key, then hack AOL, compuserve, and other FTP sites to modify the binary, but I would like to make _sure_ this program gets into user's hands without getting modified. (Not for paranoia reasons, but just to see how well one can make a package resistant to tampering.) Pardon the anonymous ID, as my reputation with my REAL user id is not so great. (No, I am not Lance, but not that better off due to tons of dumb mistakes with my regular ID on this list.) ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Re: GUI: PGP vs novices
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Thomas Grant Edwards Writes: >PGP has made me more crypto aware, but at this point neither I nor most of >the crypto aware people I personally know feel there is a need to either >encrypt or sign messages on a regular basis. It is my own personal opinion that in order for crypto to truly become mainframe, the software manufacturers of internet connectivity packages must integrate crypto into the applications. Look at the past threads here on Cypherpunks..."How do I write a script to put PGP into ELM?" "PGP DLL modularity" etc. In order to bring crypto to the masses, we have got to convince people that it is necessary. We also must make it "second nature". It sure is nice to have a menu option or a toolbar button that will encrypt plaintext automatically. Key management and some of the "high tech" (I know, for us it's nothing, but for my dad who just bought a computer and doesn't understand the difference between click, double click, and drag, crypto is a really high tech thing just in itself.) things of crypto should not be directly handled by the user. (Optional of course. On a privacy level, the user should have full control. But give the user a break...if the software is secure..as such...so is the user's privacy.) You will notice that this message is not signed. That's because in order to sign it, I would need to save my message, hop out to a DOS box, PGP encrypt it, hop back to my mail program and insert the encrypted mail as a text file. That's enough to discourage the average user. This is pretty much what Tim May was talking about when he discussed why he doesn't sign his messages. It's not that he couldn't... it's just not practical for him. It's not really practical for me either, but I do it when I feel it's necessary. The only way to make crypto practical is to basicalloy hide the technical side from the user and make it easy. That's my two cents. >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

2 1

Re: c'punks top 5
by Rich Salz 17 Dec '03

17 Dec '03

> I was reading about socks last night, and it does seem to be very close > to what is needed for this. Somebody, I forget who, had a hospitality suite at a Usenix LISA conference. They have a commercial version of socks. I don't remember if it was bundled or an option. At any rate, kinda neat that someone is providing privacy tools rather then the other way round. /r$

1 0

Have 2.6.2 but cant gen 2048 bits
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

All, Following is the output from pgp2.6.2 and me trying to generate 2048 bit keys. What am i doing rong? ;pgp -kg Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the masses. (c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94 Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc. Distributed by the Massachusetts Institute of Technology. Export of this software may be restricted by the U.S. government. Current time: 1994/12/22 07:47 GMT Pick your RSA key size: 1) 512 bits- Low commercial grade, fast but less secure 2) 768 bits- High commercial grade, medium speed, good security 3) 1024 bits- "Military" grade, slow, highest security Choose 1, 2, or 3, or enter desired number of bits: 2048 Generating an RSA key with a 1024-bit modulus. You need a user ID for your public key. The desired form for this user ID is your name, followed by your E-mail address enclosed in <angle brackets>, if you have an E-mail address. For example: John Q. Smith <12345.6789(a)compuserve.com> Enter a user ID for your public key: Thanks T

2 1

Kiwi cypherpunks
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Lads (and lasses), I seem to be having a bit of troub communicating we the kiwis on this list directly, but no probs if I send to the list. Has there been and communication on this topic in the last 3 or so days??? We cant organise anything if we cant talk to each other! T

3 2

Re: GUI: PGP vs novices
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Jeff Licquia writes: >>You will notice that this message is not signed. That's because in order to >>sign it, I would need to save my message, hop out to a DOS box, PGP encrypt >>it, hop back to my mail program and insert the encrypted mail as a text file. >>That's enough to discourage the average user. This is pretty much what Tim >>May was talking about when he discussed why he doesn't sign his messages. >>It's not that he couldn't... it's just not practical for him. It's not really >>practical for me either, but I do it when I feel it's necessary. >Just a small nit, but it appears that you're running something >Windows-compatible on your desk (the DOS box and all that). Are you aware >of the good Windows tools for PGP? The particular one I use (PGPClip by >Mike Meyer) uses the clipboard, and is very nice and simple. Exactly my point Jeff. Thank you for justifying what I said....**WINK**, **GRIN**. In order to even use PGPClip, it involves something OUTSIDE the mail application. (Although, it does sound intriguing to me.) Anyway, this is yet another example of the user needing to be fully conscious that they are signing or encrypting. It should be second nature. In order for it to become second nature, it MUST be included in the design of the mail package. (Or News reader, or FTP software, whatever.) Third party utilities make a piece of software harder to use. That's a given. Now, don't get me wrong, there are some nice thrid party vendor products out there. But, I have yet to see a crypto product that merges (cross platform) into a mail package smoothly. >Not a flame, or even a spark. Just wanting to make life easier for crypto >enthusiasts. Didn't see any sparks at all, Jeff. I am interested in PGPClip (at least to look at) does anyone have an FTP site pointer where I could find it? -- Brad >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

1 0

procmail
by cort 17 Dec '03

17 Dec '03

I just installed procmail (on my Linux system at work). The installation (readme, makefile, hand-holding along the way) was _very_ nice. It earns my hearty endorsement. Please advertise crypto enhancements to procmail to me (in email if not of general list interest). Who has the procmail integrated PGP (signing, etc.)? Cort.

1 0

RE: Have 2.6.2 but cant gen 2048 bits
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Following is the output from pgp2.6.2 and me trying to generate >2048 bit keys. What am i doing rong? You'll probably get multiple answers for this. The code in PGP that allows you to enter 2048 bit keys isn't enabled until 12/25/94, so you need to set your clock ahead to try this (and don't forget to set it back--I spent three days sending people "Christmas" mail :) Also, though I'm not sure why, it seems that the generated keys are only 2047 bits in length. This was my experience, and has been reported in alt.security.pgp by a number of others as well. Expect about a 15-20 minute key generation time on a 486/66 PC. ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLvifok1Diok8GKihAQG7ggP/SNuz/n0njIuB2NQ7iIqPH3IWQ4dzOoP0 AlBTiq80CZjVAhTR80d8ckID36cKLRjRKq3kafKqzWoDfevL8UwxXbORIs0kyo6h qnQAg98qOOQMkSh8yxYHOfYL612VMKDMuBlXDSC4dNnItkmCwex780TnZRuq9Hc/ SmkiusdPEFQ= =GFPO -----END PGP SIGNATURE-----

1 0

Re: GUI: PGP vs novices
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I just think (boy I feel repetitive) that there should be something inside the >software so the user has the option to sign, or sign on the fly. If I type up >a message and think, "hey, I really want people to know this is from me", It >would be really cool to just hit a button on the toolbar, or grab a menu >option to sign automatically before sending. You don't have to sign >everything. But, you don't have to go out to another application (of any >sort) in order to sign. It's right there in front of you. To add to this thread: I'm working on a Windows based product that, while not achieving the level of integration that you describe, does enable one to assign signature, remailing, and encryption options from within the email message itself. The product works at the Windows Sockets layer, intercepting mail as it is sent from the mail application to the SMTP host, and performing the above crypto related functions based on text placed at the top of the mail message. - From the user perspective, I plan to make the product look just like the (excellent) Unix based PGP front end, premail. So, while you're typing your mail, if you want to add a signature, just add the line Signature: <userid> to the top (where userid is something that identifies the secret key to use). Features will include automatic signing, encryption, or remailing based upon destination address of the outgoing email. Incoming mail will be handled similarly, though there are some security issues surrounding automated access to your secret keyring that I haven't thought through yet. A major complication that I've come up against is installation. Somehow I've got to provide a painless way of discovering the Winsock stack in use on a machine, and installing my WINSOCK.DLL so that it gets loaded instead of the real one (which my software then loads on its own and intercepts calls to.) This is really easy to do manually when one has knowledge of such things; it is a major pain in the ass to come up with a way of doing this that doesn't require the user to know anything about Windows Sockets or DLL's or path variables, etc. On the other hand, the pain of installation only occurs once. For actual use, adding control lines to the top of one's mail is pretty simple. Not as good as having, say, "Encrypt", "Sign", and "Remail" buttons or menu items, but it should do for now. I may or may not have something to show at the next Cpunks meeting--depends on how frustrated I get with dealing with Windows' programming paradigm :) ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLviluE1Diok8GKihAQEGfAP/TRvp2ulO5MZJplYhwoFl5hvOmvSj1nNg N25aNm4++xzdywZ7ffPhIW6v2euk27eZLJS3p+CLcZ2JWQglmqWube3lQfg9mYsB cTf+w5Jyg+lDwvXExJ+9Fqe1mZLSIS+f2jeuAi6nJ5nFyeyYWTiWBmXP0gK7YQhC 5mCFzczhP8Q= =A9RZ -----END PGP SIGNATURE-----

1 0

Kiwi cypherpunks
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

storm(a)marlin.ssnet.com said on 22-dec-1994 >The wise _DNA_ is known to have said... >> >> Lads (and lasses), >> I seem to be having a bit of troub communicating >> we the kiwis on this list directly, but no probs if I send to the >> list. Has there been and communication on this topic in the last >> 3 or so days??? We cant organise anything if we cant talk to each >> other! > >Now who says the Aussie intelligence services aren't any good? :-) Um, using the words aussie & intelligence in the same sentence is a bit of an contridiction in terms! @:)> I just dosent happen! T

1 0