December 2003 - cypherpunks-legacy

MIME Security Issues
by Richard Potocki 17 Dec '03

17 Dec '03

Does anybody wish to express any comments regarding MIME security. I have read the RFC's and any/all doc's I could find on this issue. I understand what the security risks are, but I have been unsuccessful in my attempts to find info regarding what is being done, or has been done to correct this. If I remember correctly, I think I once saw a brief mention of filters or something. I am new to this stuff, so any assistance would greatly appreciated. Thank you, Rick

2 1

Child Porn, Morphing, and Pointers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:40 PM 9/14/95, Rev. Ben wrote: >> The bill would expand the definition of child pornography >> to include any photograph, film, videotape or computer >> image produced by any means, including electronically by >> computer, if it depicts or appears to depict a minor >> engaging in sexually explicit conduct. > >If I'm reading this correctly, if I Photoshop a kids face onto the body >of the latest Playboy centerfold, I'm in violation of this proposed law? I believe there have already been prosecutions along these lines. For example, do you think a _comic book_ with child porn themes ("explicit" art, situations) would not be prosecuted as child porn? I strongly suspect that a _painting_ of a 7-year-old girl engaged in a sex act would result in a prosecution. Keith Henson, amongst others, has long suggested that a good test case will be the _morphing_ of legal images to make them look like child porn. This is not a legal list--for that there are several other fora/forums--but it is clear that the child porn laws are not necessarily aimed at the protection of specific minor children from "exploitation," as the laws apply to porn imported from countries where the age of consent is lower, apply to images of dead children (who can no longer be exploited by the images), and to "created" images of children (morphing, cut-and-paste, paintings, etc.) The laws are clearly aimed at both extinguishing the _market_ for child pornography and the _thoughts_ themselves, not at the protection of specific children. (Advocates will argue that by suppressing the production of child porn markets, future children may be protected....) The main Cypherpunks theme I can find here is this: anonymous remailers and Web proxies will be used to access offshore (or indeterminately located) sites. The Feds will likely come down very hard on any remailers or proxies found to be "trafficking" in such materials. I'm going to post to this list a recent post I made to the Cyberia list about whether pointers are the same as transfers. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Linking = Showing = Transferring?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I posted this to the Cyberia mailing list, but think it has some implications for Cypherpunks as well. And, I'm responding to Duncan Frissell, one of our own. (I don't advise subscribing to Cyberia unless legal issues interest you and you have the time for another high-volume mailing list. Still, some bright folks there--as well as some dullards. David Friedman just joined the list. To subscribe, send a message to listserv(a)listserv.cc.wm.edu with the message body of subscribe cyberia-l YourNameHere.) > >To:cyberia-l@warthog.cc.wm.edu >From:tcmay@got.net (Timothy C. May) >Subject:Linking = Showing = Transferring? > > >As good a chance as any to extend my "showing = telling" point... > >At 9:32 AM 9/14/95, Duncan Frissell wrote: > >>And my favorite: "What if the student merely includes *links* to >>the above on his web page?" Of course racist images/messages are >>always and everywhere as legal as church on a Sunday although they >>may carry civil liability in limited cases -- not a problem for >>judgment-proof students. >... >>"Is the URL the page itself? --- Unanswered philosophical questions >>of the wired age." > >_Linking_ is effectively _showing_, given the point-and-click mechanics of >hypertext. This is a situation anticipated by authors (e.g. Ted Nelson), >but is now coming to the fore. > >Granted, providing a link is not the same as actually _including_ the >material the link points to, but it is very, very close. Arguably, the >same. > >(Example: I create a home page with links to many images that are child >pornography by U.S. standards. The images themselves may be initially >stored in URLs that are in countries with different standards for consent, >e.g., Denmark or Thailand. Have I violated the child porn laws? Arguably, >I am "making available" these materials, but all I have done is to provide >the _pointers_. The readers of my home page are the actual downloaders, >not me.) > >I can imagine rebuttals to this position, arguing that an author who >includes URLs to other places is doing nothing different than an author >who includes footnoted references to other works (and surely we all agree >that footnotes are not copyright infringements of any sort). > >However, look at how the Web is being used. Home pages that have >compilations of interesting things are effectively the works! It is as if >the original materials are being stored on those home pages themselves! > >There is _technological_ and _propertarian_ fix to this: controlled or >paid access to the URLs under question. The "gatekeeper" function shifts >to the actual material under question. > >But there are many new questions. > >And Duncan's specific point remains: > >-- is it a violation of pornography laws (perhaps campus rules) to have a >home page with links to URLs containing pornographic images? > >-- is it a violation of _child pornography_ laws to have a home page with >links to URLs containing child pornography images? (The URLs could be >offshore, perhaps in jurisdictions where the age of consent is much >different than in the U.S., e.g., Denmark or Thailand.) > >-- is it a violation of national security laws to have a home page with >links to URLs containing national defense secrets? (The URLs could be >offshore.) > >-- is it a violation of copyright/patent laws to have home pages with >pointers to protected material? (Songs, written works, images, inventions, >etc.) > >And so on.... > >--Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Annonymous Web proxies.
by hallam＠w3.org 17 Dec '03

17 Dec '03

There has been a lot of debate about setting up of annonymous Web proxies. There are many thousand already deployed. Any Web proxy which does not keep logs is effectively an annonymous Web proxy. Just download the CERN server and run it. http://www.w3.org/hypertext/WWW/Daemon/Status.html The point about monitoring such sites is an apt one. Iwork under the assumption that I am monitored because if I was a spook I would be monitoring me. Most of the discoveries of security holes arrive at my door sooner rather than later. I would have monitored the communist party for the same reason, it was one of the the most obvious place for the soviets to attempt infiltration, the other being the authoritarian establishment right. Phill

1 0

Re: Mixmaster posting poll
by Erik E. Fair 17 Dec '03

17 Dec '03

At 11:40 9/13/95, Lance Cottrell wrote: > >I seem to recall that someone on this list wrote some mail2news software, >Who was it and which standard did it follow (if either). Has anyone installed >it? Is anyone else planning to install it. I will install a gateway when I >get my T1 (in a couple of months). Rich Salz wrote mail2news, based on some ugly stuff I wrote, ages ago. Erik Fair

1 0

Explaining Zero Knowledge to your children
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

There is a paper about explaining Zero Knowledge methods in simple words. It's titled "Explainig Zero Knowledge Authentication to your children" or something similar. It's said to be in the proceedings of any conference. Does anybody know where to find it? Thanks Hadmut

1 0

cryptography eliminates lawyers?
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

>From: "Cortland D. Starrett" <cort(a)bioanalytical.com> >Subject: cryptography eliminates lawyers? >As a follow-up to the article reference I posted, I pose the >following question: > >Will cryptographic technology and information (communication) >technology reduce the need for legal services in the future? >(especially regarding contracts, buying/selling, patent law, etc.) >Will legal services just look different? Will they be more >efficient (cheaper)? > >Put bluntly, will cryptography put lawyers out of business? >Any comments would be appreciated. > >Cort. > How could crypto put lawyers out of business? People would still have disagreements; plans would still go wrong; cars would still crash. More important, transactions would still need to be structured to carry out the desires of the parties while minimizing risks. Good communications technology, including crypto, could make lawyering more efficient, but I suspect the savings would be minimal. Communications technology will no more put lawyers out of business than CASE put programmers out of business. Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

4 7

AOL Porno
by Duncan Frissell 17 Dec '03

17 Dec '03

Will the federal prosecutors and Fibbies on this list please emphasize that the Internet was not involved in the AOL kiddie porn case. The Internet has enough opportunities for bad publicity as it is. DCF "Who wonders: How it is that CompuServe was able to exist from 1979 to the arrival of Prodigy and AOL without major sex, and drugs, and rock and roll problems?"

2 1

Re: DD, pedaphiles, and Terrorists, oh my
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

September 13, 1995 PRESS BRIEFING BY MIKE MCCURRY [Snip] MR. MCCURRY: ... [The President]'ll be making some fairly significant news on Thursday. So he'll be very busy next week. Q News? What kind of news? Q News on what? MR. MCCURRY: You'll see next week. [Snip] Q What about Thursday -- Q Are you going? MR. MCCURRY: Half and half, I think. I'll go -- I think there are some days that look more political; I don't think it's necessary for me to be there. Q What will be the general topic on Thursday? MR. MCCURRY: On Thursday? Technology. [Snip to end] URL: http://docs.whitehouse.gov/white-house-publications/ 1995/09/1995-09-13-press-briefing-by-mike-mccurry.text ---------- Any scuttlebutt that computer security, the Internet or encryption are the "technology?" Or related to the NYT spin today on LEA-web-snooping: "We are not going to permit exciting new technology to be misused to exploit and injure children," Attorney General Janet Reno said today in announcing the arrests. The culmination of the inquiry by the Federal Bureau of Investigatlon comes at a time when the agency has needed some favorable attention to offset a string of incidents that have cast it in a negative light. Its officials have come under fire for their role in the siege at Waco, Tex., the standoff with a white separatist in Idaho and, most recently, over an attempt to cover up aspects in the Idaho incident. Or diversion from the allegations of Special Agent Whitehurst that Feeb lab rats and bosses are corrupt -- tar-morphing even Golden Boy Freeh. Pray that kid-loving Reno HRTs the abusive brats.

1 0

[NOISE] Alice's Remailer site (was:Re: Digital Fingerprinting)
by Peter Trei 17 Dec '03

17 Dec '03

> From: patrick(a)Verity.COM (Patrick Horgan) > > From: Mac Norton <mnorton(a)cavern.uark.edu> > > To: Patrick Horgan <patrick(a)Verity.COM> > > On Wed, 13 Sep 1995, Patrick Horgan wrote: > > > > > Then, in W.Ky., as in Stockbridge, "You can get > > > > > anything you want..."? :) > > > Why do I feel like I'm sitting on the group W bench? > > I don't know, kid, what you in for? > Encryption. And they all moved away from me on the group W bench there, > talking mean hairy eyeballs and all sorts of things until I said, and > annoying the NSA, and they all moved back, talking about crime, PEM, PGP, > and liberty and justice for all;) > Patrick I've seen various 'Alice Restaurant' pastiches, Alice's NNTP server, Alices MIT GUI, etc. I guess it's time to try to do one for crypto.... This song is called Alice's Remailer site and it's about Alice, and the remailer site, but Alices Remailer site is not the name of the Remailer site, it's the name of the song, and that's why I called this song Alice's Remailer site. You can send anything you want through Alices Remailer site. You can send anything you want through Alices Remailer site. Connect right in it's around the back. Halfway down that seventeen inch rack. You can be anyone you want through Alice's Remailer site. etc.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Re: CYPHERPUNK considered harmful.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Just a couple of comments, one on a question and one on an answer. > > >Q: Aren't LEAs worried that strong encryption will make it more > >difficult for them to catch crooks? If this is for non-cypherpunks, you should say what an LEA is. They wouldn't understand your question. (Shoot, some cypherpunks are probably going, "Huh?") > > >Q: What's this 'key escrow' thing? > > > >A: Some government agencies have been trying to figure out methods which > >simultaneously permit US citizens to use strong cryptography against > >criminal eavesdroppers, while retaining the ease with which LEAs can > >currently tap your calls. The schemes generally involve something > >mistitled 'key escrow', in which copies of cryptographic keys would be > >stored at sites accessible by LEAs. > > 'key escrow' is a code word for government access to the unencrypted > message. It is a persistent theme, dating back to the NSA's CCEP in about You probably need to say what the NSA is, and certainly have to identify CCEP. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: NSA on GAK
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:01 PM 9/14/95 -0400, Adam Shostack wrote: > > "Help me understand here. You say that serious users of >encryption don't use software distributed via network. In that case, >you would have no objection to PGP being exported, as serious users of >encryption don't use it?" Were that true, then they wouldn't be on the Internet either because the Internet runs on software distributed over the Internet. DCF

2 1

Re: An opportunity not to be missed
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 14 Sep 1995, Frank Stuart wrote: > Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for > use through the remailers)? You could set up a web-page with instructions > and a list of crimes for which there are rewards. Someone already tried that. The cops got a copy of the WWW logs and started investigating everyone who'd looked at the WWW page... So at the least you'd need a bunch of anonymous WWW proxies as well. There's also the problem that the current ecash systems do not provide payee anonymity, so if you pay informers with ecash they can be traced if the bank and payer collude. Mark

3 2

Things the LEAs don't want to admit.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Andrew Loewenstern writes: <snip> >Encryption prevents 'fishing expeditions' and >unauthorized monitoring; this is what the LEAs don't want to admit. AMEN, Andrew. Another thing the LEAs don't want to admit is the incredible (cost and otherwise) effectiveness of the "Honey Trap" (SEX!) when used by (or against) them. Cash isn't the only way to recruit another Aldrich Ames(sp?), and sex is a lot easier to launder. <g> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMFh3P21lp8bpvW01AQGiawP/RbB0VL2wQ4zp712EEHt3IKz+HQpM8rjY KXXMMTdMpryBX2pWZRxm82ewYwiSwI2U+Ij67jQ+9Ev2/S1WgVCiV+se05oZ8n85 QkWI182G+Bk4JJ46/LwBDFos8gp9WRYCoRVFgA5SmV92r05MpPnrtzNUCG31D8vd FsB+JDwnZQ8= =rUVo -----END PGP SIGNATURE----- Regards, Jim Ray "When making public-policy decisions for the government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the government to deploy those technologies." -- Phillip Zimmermann, talking to himself. (Congress sure-as-hell wasn't paying attention!) ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Re: GAK
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>So would an FBI camcorder in every room of every house. >The question is where to draw the line, and I'd rather >let the lines draw themselves, as opposed to having >citizens be compelled to draw them. The telephone >system, Mr. Freeh's preferred analog, is inherently >susceptible to tapping, but what if it were not, and >every telephone were required to be equipped with >a government tap switch, subuect to warrant, of course? While not every telephone, every telephone switch is required to be tap capable - The Digital Telephony Act. Note there is provision for the government to pay costs for Telcos to make their phones tappable - as yet unfunded by Congress. The rights of The People have clearly collided with the interests of Law Enforcement. Guess who Congress likes better?

1 0

MOSS [IETF privacy-enhanced mail, modified for MIME] now available
by Rich Salz 17 Dec '03

17 Dec '03

>From pem-dev-request(a)neptune.tis.com Wed Sep 13 19:27:35 1995 Message-Id: <9509132011.AA19261(a)tis.com> Reply-To: James M Galvin <tismoss-support(a)TIS.COM> To: "MOSS.Announce.List":;, tis.com(a)TIS.COM Subject: ANNOUNCE: TIS/MOSS Version 7.1 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-Id: <2977.811023088.1(a)tis.com> Date: Wed, 13 Sep 1995 16:11:35 -0400 ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.2(a)tis.com> Trusted Information Systems, Inc. (TIS), in cooperation with RSA Data Security, Inc. (RSADSI), is pleased to provide TIS/MOSS, a reference implementation of MIME Object Security Services (MOSS). TIS/MOSS is a security toolkit that provides digital signature and encryption services for MIME objects. TIS/MOSS includes the "glue" necessary for integration with Version 6.8.3 of the Rand MH Message Handling System, in addition to generic Bourne shell scripts that make it possible to use it with email user agents supporting UNIX shell escapes. In order to foster acceptance of MOSS and provide the community with a usable, working version of this technology, TIS/MOSS is being made available for broad use on the following basis. TIS/MOSS is distributed in source code form, with all modules written in the C programming language. It runs on many UNIX derived platforms. It includes a DOS compilation directive that facilitates its port to DOS/WINDOWS. TIS/MOSS requires RSAREF, a cryptographic toolkit distributed by RSADSI. TIS/MOSS makes use of undocumented features of RSAREF. RSADSI has given permission for users of TIS/MOSS to use these features, subject to the terms and conditions of both the TIS/MOSS and RSAREF licenses, as distributed with each software package. TIS/MOSS is a product of Trusted Information Systems, Inc. It may be used by organizations and users for exchanging MOSS email messages, subject to the terms and conditions of its license. Enclosed below is the MOSS Frequently Asked Questions, which includes instructions on how to retrieve the software. TIS/MOSS is export controlled by the U.S. Government. As a result it is only available to U.S. and Canadian sites and individuals. Please see the FAQ for more information. ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.3(a)tis.com> Content-Description: TIS/MOSS FAQ TIS/MOSS Frequently Asked Questions Last Updated July 1995 Send questions and comments to tismoss-support(a)tis.com Questions answered: 1) What is MIME Object Security Services (MOSS)? 2) What is MIME? 3) How does MOSS compare to PGP and PEM? 4) Where is the MOSS standard defined? 5) Are there implementations of MOSS available? 6) How do I get TIS/MOSS? 7) Why is TIS/MOSS only available in the US and Canada? 8) Are special privileges (e.g., root access) required to install TIS/MOSS? 9) What about integrating TIS/MOSS into email user agents? 10) What about DOS and other non-UNIX platforms? 11) Is there a forum for MOSS users and developers? 12) What about certificates? 13) What is the Internet Certification hierarchy? 14) What if I have questions or problems with TIS/MOSS? * means that this entry has been recently updated. + means that this entry has been added recently. 1 Q: What is MIME Object Security Services (MOSS)? A: MOSS is a Privacy Enhanced Mail (PEM) derivative that is a Proposed Internet Standard for adding security services to Multi-purpose Internet Mail Extensions (MIME). It uses the cryptographic techniques of digital signature and encryption to provide origin authentication, integrity, and confidentiality to MIME objects. Users of MOSS can know who originated a message, that the message has not been changed enroute, and that the message was kept secret from everyone except the intended recipients. MOSS depends on the existence of public/private key pairs to support its security services. Users must exchange public keys with those other users with whom they wish to exchange MOSS email. This may be accomplished manually, via mechanisms available in the protocol, via X.509 certificates, or any other suitable mechanism. 2 Q: What is MIME? A: MIME is an Internet Standard (RFC 1521) that defines the format of email message bodies to allow multi-part textual and non-textual message bodies to be represented and exchanged without loss of information. MIME does for message bodies what RFC822 does for message headers. 3 Q: How does MOSS compare to PGP and PEM? PGP can provide the same services but since it is not integrated with MIME the interpretation of the protected content is necessarily user controlled. Note, however, that MIME can carry a PGP object. MOSS is a PEM derivative. It integrates the security services of PEM with MIME, taking advantage of the extensive structuring and formatting facilities of MIME, limited versions of which are necessarily an integral part of the PEM specifications. 4 Q: Where is the MOSS standard defined? A: There is a Proposed Standard published as an RFC that specifies MOSS. This document may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info(a)ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 5 Q: Are there implementations of MOSS available? A: Yes, Trusted Information Systems (TIS), under ARPA sponsorship, has released a reference implementation of MOSS (TIS/MOSS) to the Internet community. TIS/MOSS is a UNIX-based implementation that is easily integrated with email user agents. The source code is openly available in the United States and Canada for non-commercial use. The current version of TIS/MOSS is 7.1. Vendors interested in including TIS/MOSS in their products or integrating it with their services should contact Trusted Information Systems about licensing Trusted Mail (tm) by sending email to tismoss-support(a)tis.com. 6 Q: How do I get TIS/MOSS? A: TIS/MOSS is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/MOSS please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/MOSS/README pub/MOSS/LICENSE pub/MOSS/BUGS The README file contains further instructions. 7 Q: Why is TIS/MOSS only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/MOSS is controlled by the United States government. 8 Q: Are special privileges (e.g., root access) required to install TIS/MOSS? A: No. 9 Q: What about integrating TIS/MOSS into email user agents? A: TIS/MOSS includes "glue", in the form of shell scripts, to integrate it with the Rand MH Message Handling System version 6.8.3. It also includes generic scripts that make the services accessible to any UNIX application that supports shell escapes. If you integrate TIS/MOSS with a popular email user agent, we would be happy to make it available to others. 10 Q: What about DOS and other non-UNIX platforms? A: TIS/MOSS has been ported to DOS and includes a DOS compiler option that may be set to facilitate its installation in DOS environments. It has also been ported to Macintosh although it does not yet include a MAC compiler option. If you port TIS/MOSS to other platforms, we would be happy to make the changes available to others. 11 Q: Is there a forum for MOSS users and developers? A: Yes, there is an email list for users of TIS/MOSS called "tismoss-users(a)tis.com". To get added to the list send a message to "tismoss-users-request(a)tis.com". There is an email list for implementors and discussions of the MOSS specifications called "pem-dev(a)tis.com". This list originated with the PEM protocol, from which MOSS is derived. To get added to the list send a message to "pem-dev-request(a)tis.com". 12 Q: What about certificates? A: TIS/MOSS supports the use of X.509 certificates including creation, validation, certificate revocation lists, distribution, and destruction. Users may embody their public key in a certificate and may participate in the Internet certification hierarchy or some other private hierarchy. TIS/MOSS neither requires nor enforces any certification hierarchy policy. 13 Q: What is the Internet Certification hierarchy? A: The Internet Certification hierarchy is defined by RFC1422. It is a tree structured hierarchy of certificates with a single, global root called the Internet PCA Registration Authority (IPRA). The IPRA issues certificates to Policy Certification Authorities (PCAs) who issue certificates to Certification Authorities (CAs) who may issue certificates to users or subordinate CAs. Identities are based on distinguished names and there are restrictions on their form and content. For more information on becoming a PCA see the IPRA WWW page at: http://bs.mit.edu:8001/ipra.html or contact the IPRA at: ipra-info(a)isoc.org For more information on becoming a CA under the TIS PCA contact: tispca-info(a)tis.com 14 Q: What if I have questions about or problems with TIS/MOSS? A: Send them to "tismoss-support(a)tis.com". ------- =_aaaaaaaaaa0 Content-Type: multipart/signed; protocol="application/moss-signature"; micalg="md5"; boundary="----- =_aaaaaaaaaa1" ------- =_aaaaaaaaaa1 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.5(a)tis.com> Trusted Information Systems, Inc. (TIS), in cooperation with RSA Data Security, Inc. (RSADSI), is pleased to provide TIS/MOSS, a reference implementation of MIME Object Security Services (MOSS). TIS/MOSS is a security toolkit that provides digital signature and encryption services for MIME objects. TIS/MOSS includes the "glue" necessary for integration with Version 6.8.3 of the Rand MH Message Handling System, in addition to generic Bourne shell scripts that make it possible to use it with email user agents supporting UNIX shell escapes. In order to foster acceptance of MOSS and provide the community with a usable, working version of this technology, TIS/MOSS is being made available for broad use on the following basis. TIS/MOSS is distributed in source code form, with all modules written in the C programming language. It runs on many UNIX derived platforms. It includes a DOS compilation directive that facilitates its port to DOS/WINDOWS. TIS/MOSS requires RSAREF, a cryptographic toolkit distributed by RSADSI. TIS/MOSS makes use of undocumented features of RSAREF. RSADSI has given permission for users of TIS/MOSS to use these features, subject to the terms and conditions of both the TIS/MOSS and RSAREF licenses, as distributed with each software package. TIS/MOSS is a product of Trusted Information Systems, Inc. It may be used by organizations and users for exchanging MOSS email messages, subject to the terms and conditions of its license. Enclosed below is the MOSS Frequently Asked Questions, which includes instructions on how to retrieve the software. TIS/MOSS is export controlled by the U.S. Government. As a result it is only available to U.S. and Canadian sites and individuals. Please see the FAQ for more information. ------- =_aaaaaaaaaa1 Content-Type: application/moss-signature Content-ID: <2977.811023088.4(a)tis.com> Content-Transfer-Encoding: quoted-printable Version: 5 Originator-ID: PK,MHkwCgYEVQgBAQICAwADawAwaAJhAMAHQ45ywA357G4fqQ61aoC1fO6B= ekJmG4475mJkwGIUxvDkwuxe/EFdPkXDGBxzdGrW1iuh5K8kl8KRGJ9wh1HU4TrghGdhn0Lw8g= G67Dmb5cBhY9DGwq0CDnrpKZV3cQIDAQAB,EN,2,galvin(a)tis.com MIC-Info: RSA-MD5,RSA,jZjz1ope/QCf2IwPfkXfB+0bNJsFqJny+xVqjyFaW6QAY0Oy4dru= PxTgYleEFG2qQBP6rbNiucG7g254ClV6hUMG6ksd+qFioFvxqsJ15WylN7Addo/QCzknzhRo45= 6l ------- =_aaaaaaaaaa1-- ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.6(a)tis.com> Content-Description: TIS/MOSS FAQ TIS/MOSS Frequently Asked Questions Last Updated July 1995 Send questions and comments to tismoss-support(a)tis.com Questions answered: 1) What is MIME Object Security Services (MOSS)? 2) What is MIME? 3) How does MOSS compare to PGP and PEM? 4) Where is the MOSS standard defined? 5) Are there implementations of MOSS available? 6) How do I get TIS/MOSS? 7) Why is TIS/MOSS only available in the US and Canada? 8) Are special privileges (e.g., root access) required to install TIS/MOSS? 9) What about integrating TIS/MOSS into email user agents? 10) What about DOS and other non-UNIX platforms? 11) Is there a forum for MOSS users and developers? 12) What about certificates? 13) What is the Internet Certification hierarchy? 14) What if I have questions or problems with TIS/MOSS? * means that this entry has been recently updated. + means that this entry has been added recently. 1 Q: What is MIME Object Security Services (MOSS)? A: MOSS is a Privacy Enhanced Mail (PEM) derivative that is a Proposed Internet Standard for adding security services to Multi-purpose Internet Mail Extensions (MIME). It uses the cryptographic techniques of digital signature and encryption to provide origin authentication, integrity, and confidentiality to MIME objects. Users of MOSS can know who originated a message, that the message has not been changed enroute, and that the message was kept secret from everyone except the intended recipients. MOSS depends on the existence of public/private key pairs to support its security services. Users must exchange public keys with those other users with whom they wish to exchange MOSS email. This may be accomplished manually, via mechanisms available in the protocol, via X.509 certificates, or any other suitable mechanism. 2 Q: What is MIME? A: MIME is an Internet Standard (RFC 1521) that defines the format of email message bodies to allow multi-part textual and non-textual message bodies to be represented and exchanged without loss of information. MIME does for message bodies what RFC822 does for message headers. 3 Q: How does MOSS compare to PGP and PEM? PGP can provide the same services but since it is not integrated with MIME the interpretation of the protected content is necessarily user controlled. Note, however, that MIME can carry a PGP object. MOSS is a PEM derivative. It integrates the security services of PEM with MIME, taking advantage of the extensive structuring and formatting facilities of MIME, limited versions of which are necessarily an integral part of the PEM specifications. 4 Q: Where is the MOSS standard defined? A: There is a Proposed Standard published as an RFC that specifies MOSS. This document may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info(a)ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 5 Q: Are there implementations of MOSS available? A: Yes, Trusted Information Systems (TIS), under ARPA sponsorship, has released a reference implementation of MOSS (TIS/MOSS) to the Internet community. TIS/MOSS is a UNIX-based implementation that is easily integrated with email user agents. The source code is openly available in the United States and Canada for non-commercial use. The current version of TIS/MOSS is 7.1. Vendors interested in including TIS/MOSS in their products or integrating it with their services should contact Trusted Information Systems about licensing Trusted Mail (tm) by sending email to tismoss-support(a)tis.com. 6 Q: How do I get TIS/MOSS? A: TIS/MOSS is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/MOSS please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/MOSS/README pub/MOSS/LICENSE pub/MOSS/BUGS The README file contains further instructions. 7 Q: Why is TIS/MOSS only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/MOSS is controlled by the United States government. 8 Q: Are special privileges (e.g., root access) required to install TIS/MOSS? A: No. 9 Q: What about integrating TIS/MOSS into email user agents? A: TIS/MOSS includes "glue", in the form of shell scripts, to integrate it with the Rand MH Message Handling System version 6.8.3. It also includes generic scripts that make the services accessible to any UNIX application that supports shell escapes. If you integrate TIS/MOSS with a popular email user agent, we would be happy to make it available to others. 10 Q: What about DOS and other non-UNIX platforms? A: TIS/MOSS has been ported to DOS and includes a DOS compiler option that may be set to facilitate its installation in DOS environments. It has also been ported to Macintosh although it does not yet include a MAC compiler option. If you port TIS/MOSS to other platforms, we would be happy to make the changes available to others. 11 Q: Is there a forum for MOSS users and developers? A: Yes, there is an email list for users of TIS/MOSS called "tismoss-users(a)tis.com". To get added to the list send a message to "tismoss-users-request(a)tis.com". There is an email list for implementors and discussions of the MOSS specifications called "pem-dev(a)tis.com". This list originated with the PEM protocol, from which MOSS is derived. To get added to the list send a message to "pem-dev-request(a)tis.com". 12 Q: What about certificates? A: TIS/MOSS supports the use of X.509 certificates including creation, validation, certificate revocation lists, distribution, and destruction. Users may embody their public key in a certificate and may participate in the Internet certification hierarchy or some other private hierarchy. TIS/MOSS neither requires nor enforces any certification hierarchy policy. 13 Q: What is the Internet Certification hierarchy? A: The Internet Certification hierarchy is defined by RFC1422. It is a tree structured hierarchy of certificates with a single, global root called the Internet PCA Registration Authority (IPRA). The IPRA issues certificates to Policy Certification Authorities (PCAs) who issue certificates to Certification Authorities (CAs) who may issue certificates to users or subordinate CAs. Identities are based on distinguished names and there are restrictions on their form and content. For more information on becoming a PCA see the IPRA WWW page at: http://bs.mit.edu:8001/ipra.html or contact the IPRA at: ipra-info(a)isoc.org For more information on becoming a CA under the TIS PCA contact: tispca-info(a)tis.com 14 Q: What if I have questions about or problems with TIS/MOSS? A: Send them to "tismoss-support(a)tis.com". ------- =_aaaaaaaaaa0--

2 1

Corrections to "Ron Plesser's take on NIST GAK"
by John Gilmore 17 Dec '03

17 Dec '03

There were a few sentences truncated in what I posted yesterday, due to mistakes on my part. Here's the corrections. John ... The Administration policy for 40-bit-key encryption will continue as-is, and no keys will have to be escrowed for such systems. Mr. Nelson said that the government's main concern is that strong encryption products not be available in the mass market. ... bi-lateral agreements with friendly nations. In a presentation, Bob Holleyman of the Business Software Alliance criticized the Administration's failure to "liberalize export controls on generally available software employing non-key escrow encryption." Also, he stated that the Administration's proposal and the draft criteria "continue to reflect a misunderstanding of the market place and, if implemented in anything like their current form, will prevent key escrow encryption from ever being commercially adopted." Mr. Holleyman recommended a number of features for a marketable system, including a variety of encryption algorithms using at least 64-bit keys and user specification of a key holder.

1 0

Re: cryptography eliminates lawyers?
by dsc＠swcp.com 17 Dec '03

17 Dec '03

Black Unicorn wrote, [snip] >> We seem to be having problems with the meanings of words. For example, I >> make a distinction between certification and licensing. > >Which, as I have indicated, I see as a "distinction without a difference." We're at a standoff here. [snip] >So you wouldn't consider the Hollywood blacklist coercive? >What about revocation of tax free status? Not as you describe it. No. [snip] > >> And I see a >> big difference in a market based monopoly and a government based monopoly. >> > >Which, I think, is your key error- particularly in the context of this >licensing issue, where the difference is nearly invisible. This is our standoff. [snip >I think your hangup is one of overdemonizing the state to the point where >no other evils seem to exist. Actually, I think that much coercion (as I used it) is outside the state. I also believe there is much evil outside of coercion but that is probably outside the scope of the topic. I do admit that I am emphasizing coercion and using that as the dividing line more than other types of evil. [snip] > Though one might >> think of physical force as applying to murder, kidnapping, slavery, >> assault, robbery, physical theft, I would also apply it to theft or damage >> of abstract property that has properties like physical property. I intend >> for these to apply to many actions of the state. > >I think you have failed to apply them to other organizations. Again, I >think you are over amoured with hating "the state." Many organizations >not affiliated with government do violence to abstract properties. I refered to the physical force used by gangs to enforce neighborhood rules. After pondering this, I think this does not apply to my approach. The state is brought up because it is the agent of coercion in licensing. [snip] >If I am a producer in a horizontal territory limitation agreement for >sales of wigets, and bob is not, bob's attempt to move into my area and >sell widgets will be met with a boycott by all the members of my >agreement. Is this any less coercion? I understand the violence is >fairly dramatic coercion, but it is hardly the only coercion. Do you not >consider the Clipper program coercion? The first is not. The Clipper program (as I understand it) is. Remember, my guideline is simple threat of physical harm. >I suggest you take a look at Nozick, Coercion, in Philisophy, Science and >Method (S. Morgenbessed ed. 1969) or Zimmerman, Coervice Wage Offers, 10 >Phil & Pub. Aff. 121 (1981) Also, see Kreimer, Allocational Sanctions: >The Problem of Negative Rights in a Positive State, 132 U. Pa. L. Rev. >1293 (1984). I'll look for Nozick. [snip] >> >I guess the center of my question is, how can you apply Web of Trust to >> >e.g. a university degree. Who cares what Bob and Alice think my degree >> >is in, the client only wants to know from the institution. >> >> It does not matter why people would trust a certifying entity. It might >> have a great earned reputation, it might "borrow" some reputation from >> bonding or audits, or it might have ties to the Real World. > >Exactly, it must be tied to some kind of authority. In this case, the >issuing institution is about the only acceptable one. > >I stand by the contention that a University degree cannot be certified >acceptably by an authority not in some way connected to the University. I think such a certification is consistent with my desire for alack of physical coercion in this. I assume you'd be willing to let the market prove this point. [snip] >You are using coercion in a different sense. One of the definitions I >get in Webster's (while force is incorporated in some others) is "to >compel to do something by the use of power, intimidation or threats." > >If you perfer that I use "serious persuasion" instead, fine, but I think >you are just splitting hairs. I think there is a big difference between "I'm going to break your house windows unless you give me $50" and "I'm going to stop delivering milk unless you pay your $50 milk bill". [snip] >Do you believe it impossible/insignificant to manipulate behavior by >persuasive means other than violence or the threat of actual physical >violence? No. And for me there are cases when it would be wrong. I won't comment on when it is wrong for others, but in the alternate case that includes violence or the threat, I will say it is wrong. >> >Can't the multiple authorities set common >> >or near common guidelines? Rather, don't they HAVE to in order to have >> >their signatures worth the electrons they are transmitted with? >> >> In general, No. Under many conditions market forces make services alike, >> but more often competing businesses find particular market niches. > >An example please? With specific regard to certifing authorities and >university degrees? A BA and BS have become practically the same, but a BSET (tech) is very different from a BSEE (engineer). [snip] >I still am having trouble understanding your definition of coercion. [snip] >> I see a big difference in withholding a signature and sending gunmen. >> There is no violence in withholding a signature. > >There is no PHYSICAL violence, this I have admitted, but the economic >violence of such an act can be significant. It seems that for you the >distinction is in the emotional effect of the application of persuasive >force, rather than the effect. Oh. You are right in the last part. The distinction is NOT the effect. Not the emotional effect either. It is the ethics and pragmatics of relying of a competition of ideas and not force. To put it bluntly, coercion (as I defined it: murder, theft, ...and the threat thereof) a sin. [snip] >Allowing emotion to cloud one's judgement of what is and is no coercive >is a mistake. Agreed. I have clear guidelines. >I believe that your defining the words merely to distinguish who the >certifing authority is confusing- and deceptive. The concepts of coercive methods and noncoercive methods are there regardless of the words. I prefer agents of the first over agents of the latter. [snip] >[market monopolies are "softer" than government ones.] [Agreed.] [snip] >The base requirement of a certification from an education institution >(for which you have provided no substitute). Let the market decide if there really is one. >The existance of a floor, below which it is impractical to practice a >profession and the existance of a set of entities (of whatever number) >who's signatures are required to transcend this floor. Let the market decide. [snip] >> Perhaps, I could have use the phrases "non-coercion-based" licensing and >> "coercion-based" licensing, but I am not comfortable with these--trade >> licensing invokes too violent of an image. > >I think this construction is still flawed. I will remain by my position >that licensing is useful when not used to collect taxes or >otherwise overregulate. I also hold that the distinctions you make >between licensing and certification are without functional difference in >effect and are deceptive in that they suggest a significant difference in >effect or purpose where there is none. > The difference in effect is in emergent market optimization. The difference in purpose is ethical. I have learned that you--and perhaps others--do not see an important difference in these two styles of influencing behavior. I see a major difference and in thinking the difference was obvious was slow in understanding your position. Great. You're already enjoying breakfast and I still have to go to bed. Dar =========================================================== Dar Scott Home phone: +1 505 299 9497 Dar Scott Consulting Voice: +1 505 299 5790 8637 Horacio Place NE Email: darscott(a)aol.com Albuquerque, NM 87111 dsc(a)swcp.com Fax: +1 505 898 6525 http://www.swcp.com/~correspo/DSC/DarScott.html ===========================================================

2 1

Re: Linking = Showing = Transferring?
by joseph＠genome.wi.mit.edu 17 Dec '03

17 Dec '03

>>And Duncan's specific point remains: >> >>-- is it a violation of pornography laws (perhaps campus rules) to have a >>home page with links to URLs containing pornographic images? >> >>-- is it a violation of _child pornography_ laws to have a home page with >>links to URLs containing child pornography images? (The URLs could be >>offshore, perhaps in jurisdictions where the age of consent is much >>different than in the U.S., e.g., Denmark or Thailand.) >> >>-- is it a violation of national security laws to have a home page with >>links to URLs containing national defense secrets? (The URLs could be >>offshore.) >> >>-- is it a violation of copyright/patent laws to have home pages with >>pointers to protected material? (Songs, written works, images, inventions, >>etc.) >> >>And so on.... Here's my question, and a thought to ponder: If it is/becomes illegal to have links on a homepage to pornography because it is ruled as the same as having the pornography there; then can you have links to pages with links (the same as having it) to pornography? This repeats, so would it be legal to links at all? -------------------------------------------------------------------------------- Joseph Sokol-Margolis joseph(a)genome.wi.mit.edu Assistant Systems Administrator seph(a)mit.edu Whitehead Institute/MIT Center for Genome Research phone: (617) 252-1922 One Kendall Sq. Bldg. 300 fax: (617) 252-1902 Cambridge, MA 02139-1561 ----------------------http://www-genome.wi.mit.edu/~joseph/----------------- ----

1 0

Mixmaster status changing
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I recently promised to release the next version of Mixmaster (V 2.0.2) within 48 hours. The situation has changed. The release of the next version of Mixmaster will be indefinitely delayed. There has been an offer to purchase and commercially develop Mixmaster. This will hasten the development of Mixmaster for other platforms (e.g. Dos, Windows Macintosh), and bring significant improvements to the interface, but I will not compromise on the level of security provided by Mixmaster. Free client software will continue to be available. This could be the big breakthrough for remailers, finally thrusting them out of the hobbyist's closet into the corporate world. We have all known that remailers would not become widely used by the rest of the word until they were easy to use. Many corporations also fear freeware because of its unknown provenance and its lack of support. I apologize for the delay, but I think that the wait will be worth it. -Lance M. Cottrell <loki(a)obscura.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFimnfPzr81BVjMVAQEfpQgAktbVCj3f39sXtTHPL/H2qh6xJuSvozv1 YXai2/NOh9Y5+qTYJS0R1u8+xSdzQlwfvbdteeXtqK0Ba9QBa2tIPwo0jVVvnano eyFSic0+FoPg33geVGO7Opn+RjOIsvz1MXD41mHxB7p9tRClnEuenvTKqjWovHwU wQX8mDRsz14cqN1x4YN5MtiFZwz+FgqD8r3O/u6eAT032X0KirfPkxwyIFbfOqz4 crxR/P6KJ7GZzxfyYjoAjOSSan1VkAcp11HzmFU37PA/LB8kbKyYxCrfg+grQu+x cDMGvb/xg6cwD+D/D7RTUT756m4TDpbgzaNy9SIQTAnbAAspZXZ1mA== =GIrJ -----END PGP SIGNATURE----- -- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Privtool 0.85 Released
by Rev. Mark Grant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I've just released a new version of Privtool, with a large number of bugfixes and new features. It's available from ftp.c2.org as /pub/privtool/privtool-0.85.tar.gz, and in Europe from ftp.dsi.unimi.it in /pub/security/crypt/code, or from ftp.ox.ac.uk in /pub/crypt/pgp/utils. DUE TO US ITAR REGULATIONS, IF YOU ARE OUTSIDE THE US YOU SHOULD DOWNLOAD PRIVTOOL FROM A NON-US SITE. Dumb, but true... Documentation is also available on the WWW at http://www.c2.org/~mark/privtool/privtool.html. Mark Privtool Beta Release @(#)README.1ST 1.34 9/12/95 ----------------------------------------------------- Privtool ("Privacy Tool") is intended to be a PGP-aware replacement for the standard Sun Workstation mailtool program, with a similar user interface and automagick support for PGP-signing and PGP-encryption. Just to make things clear, I have written this program from scratch, it is *not* a modified mailtool (and I'd hope that the Sun program code is much cleaner than mine 8-) !). When the program starts up, it displays a list of messages in your mailbox, along with flags to indicate whether messages are signed or encrypted, and if they have had their signatures verified or have been decrypted. When you double click on a message, it will be decrypted (requesting your passphrase if neccesary), and/or will have the signature checked, and the decrypted message will be displayed in the top part of the display window, with signature information in the bottom part. The mail header is not displayed, but can be read by pressing the 'Header' button to display the header window. In addition, the program has support for encrypted mailing list feeds, and if the decrypted message includes another standard-format message it will replace the original message and be fed back into the display processing chain. When composing a message or replying to one, the compose window has several check-boxes, including one for signature, and one for encryption. If these are selected, then the message will be automatically encrypted and/or signed (requesting your passphrase when neccesary) before it is sent. You may also select a 'Remail' box, which will use the Mixmaster anonymous remailer client program to send the message through one or more remailers. Being an Beta release, there are a number of bugs and nonfeatures : Known Bugs : When you save changes to the mail file, it throws away the signature verification and decrypted messages, so that the next time you view a message it has to be verified or decrypted again. Privtool requires that the /usr/spool/mail directory is world-writable. Some versions of Linux are set up to have mail programs setgid mail, and have write access only to mail and root, causing hangs when saving changes. This will be fixed in the next release. Header window is not updated if left open. Date parsing on Linux is not quite correct. Problem with compose window layout if using Bcc: or extra header lines. Crashes if you tab from the Cc: field to the message body. Known Nonfeatures : Currently if you send encrypted mail to multiple recipients, all must have valid encrpytion keys otherwise you will have to send the message decrypted. Also, the message will be sent encrypted to all users, not just the one who is receiving each copy. Only one display window. Code should be more modular to assist with ports to Xt, Motif, Mac, Windows, etc. Not very well documented ! Encrypted messages are saved to mail files in encrypted form. There is currently no option to save messages in decrypted form. No support for anonymous return addresses. Not very well tested on Solaris 2.x, or Linux. Changes for 0.85: Support for Reply-To: addresses in message headers. If you have PGP Tools, then the passphrase is now stored in MD5 form rather than as ASCII text. This will make it harder to steal your passphrase if you're running on a multi-user machine (which you shouldn't be, but many of us are). Improved documentation. 'New mail' indicator in icon now goes away if you open the window and close it again without reading any messages. Support for multiple compose windows - no more pressing 'Reply' and screaming because you deleted the message you were editing ! Query on exit if any compose windows are open. Show busy cursor for time-consuming operations. Kill-by-name and Kill-by-subject now work correctly. 'Add Key' button now works. Optionally beep on bad signature. Added various changes from Anders Baekgaard (baekgrd(a)ibm.net) we can how use a more normal icon if preferred, pass arguments on the command line, specify the font to use, support the 'showto' option, allow X-resources to be set up, fix a bug in Linux which showed the message list as a black box, cleaned up some warnings from x.c, support bcc:, and have an option for a simplified, smaller, display layout for machines with small screens. Fixed some memory leaks in deliver_proc (). Anders finally got the scrollbar to go to the right place when opening mail files ! Yay !!!! Fixed bad arguments that were being passed to bzero() in pgplib.c and potentially causing random memory overwrites. Fix for Linux icon corruption from A J Teeder (ajteeder(a)dra.hmg.gb) Added 'resend' to resend a message that failed the first time. Added Linux-specific Makefile, now that I have my own Linux box to test it on. Fixed SEGV when delivering messages (with some .mailrc files), caused by a bug in the alias-handling code. Privtool can be compiled to either use PGP Tools, or to fork off a copy of PGP whenever it is needed. There are also a number of different security level options for the passphrase, varying from 'read it from PGPPASS and keep it in memory' to 'request it every time and delete it as soon as possible', via 'request it when neccesary and delete it if it's not used for a while'. Unfortunately, PGP Tools (or at least the version that I have) does not appear to work correctly on Linux. See the README file for information on compiling the code, and the user.doc file for user documentation (the little that currently exists). You should also ensure that you read the security concerns section in user.doc before using the program. Mark Grant (mark(a)unicorn.com) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQEVAgUBMFileFVvaTo9kEQVAQFU6ggAk9MWUkT3b6b6dGpzZSiCR/pGM6SMdXIP ZCcE546a65cOl3esgdVSSUlaw3SDGt1FxuHB/pzPqTJBqaZNsPoSrvZbPSz0Fcl7 GjuDCGFIm4vPYi8tgoTc2WPbj4E0w1O5+vZvZWwvm/TrzfYNeMnlI3wWb18U+TXF hj9tOKbd1rmzx3an/ZGgfFzwlKtidPbLhOPxxv7XWFkpZAXbKAesKPw85sNilxy4 NwerRu9OAXBVNHGgJfM6S6+qfYygCuzIodseMwpOU+7uL1MfvB6LFJ5WL3di3FdA Hnv2CKbqmEVWlFc1TIY0mK6Ze+U/uRlgbM04/GLk1X3qM8r4SQUqwg== =jd5V -----END PGP SIGNATURE-----

1 0

Re: [NOISE] Alice's Remailer site
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > And can you imagine FIFTY people a day? I said FIFTY people a day -- > loggin' in, sending mail through Alice's Remailer site and loggin' out? > And friends, they may think it's a MOVEMENT, and that's what it is: > > THE ALICE'S REMAILER SITE ANTI-E-MAIL-SNIFFING MOVEMENT!-- > > and all you gotta do to join is to flip the bird to those traffic-sniffin' > spooks out there -- With feelin' ... > > > -Tom Swiss / tms(a)tis.com > There sure are a lot of us old fogies around here:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: AOL Porno
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:25 AM 9/14/95 -0400, you wrote: >Will the federal prosecutors and Fibbies on this list please >emphasize that the Internet was not involved in the AOL kiddie porn >case. The Internet has enough opportunities for bad publicity as >it is. I watched the local news coverage of that case. The report was given by an individual who has made that mistake before. (He hosts a "Town Hall" program that exploits various subjects of the day. He was corrected as to "AOL not being the Internet" during one of them. I know, I was the one who corrected him.) The coverage showed lots of shots of the various internet binaries echos (including alt.binaries.pictures.erotica.children, but not alt.binaries.pictures.cops.), the web including the Penthouse site (as if Penthouse has kiddy porn), and other unrelated and non-AOL pictures. The Internet has become the new scapegoat of choice. The general media cannot (or is unwilling) to distinguish the difference between electronic nets. The Internet is a generic term for them and since when is the media willing to look beyond the surface? How does this connect to crypto? Well, aiding and abetting in a scapegoat is a capitol crime in this country. You can be assured that the Department of Scapegoat Management will link kiddy porn and crypto at some point in the minds of the generic public. Hopefully that perception can be "headed off at the pass". Having cryptography as a means of avoiding crime and criminals in the perception of the public is a good idea. The question is how to get that perception into the minds of the general public before the other meme can be inplanted by Scapegoat management and the other TLAa? >"Who wonders: How it is that CompuServe was able to exist from 1979 >to the arrival of Prodigy and AOL without major sex, and drugs, and >rock and roll problems?" I think the six-dot-three filenames has something to do with it... | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: cryptography eliminates lawyers?
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Davis wrote: <snip> >Just wondering about liability issues after state accrediting is dead. <snip> <I can resist jumping in no longer...> Despite loud squawking, "chaos" will not ensue. Instead, the private sector will take over assesing risk, which it has always done better. An example: I'd rather jump into a full bathtub with a plugged-in, UL [Underwriter's Laboratories] certified TV set than take the FDA approved (but very dangerous, IMO) prostate drug called "Proscar." While there is only one UL (by choice, not force) and only one FDA (by force, not choice) I can easily imagine a lawyer-certifying companies like UL for appliances, probably tied [like UL] to the insurance industry. [I am not a lawyer, or a doctor either.] JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMFiyw21lp8bpvW01AQGWmQP/QrIwiASIcwWZ6T6mcg7lB+BknBzlgBjy IXMdTalqk5gepHhO386QiA4XNdhlBtaJWpOCQkqRu4M7MrSlCZBuPTNgyu5DJRNS Ru7X/XVWzCKrODWGg8o45GblveNQker7XOJp6v5cmU5xyo2hZNvwZlPb4jq2fWou wW/Amy49BNA= =Nbil -----END PGP SIGNATURE----- Regards, Jim Ray "When making public-policy decisions for the government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the government to deploy those technologies." -- Phillip Zimmermann, talking to himself. (Congress sure-as-hell wasn't paying attention!) ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

2 1

Re: NSA on GAK
by Rich Salz 17 Dec '03

17 Dec '03

>> Internet runs on software distributed over the Internet. This is more like an aphorism than a true statement.

1 0