December 2003 - cypherpunks-legacy

Re: Compuserve grovels to foreign censors
by Chris Claborne 17 Dec '03

17 Dec '03

At 01:47 PM 1/5/96 -0500, you wrote: >At 12:56 AM 1/5/96 -0500, Larry Sudduth wrote: > >>Attachment Converted: C:\WORK\WINMAIL.DAT > >What, pray tell, is this? If a MSMail for Windows user attaches a file to her message, it also sends along the icon for the ride. This file could also be a picture that someone pasted in to their message. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Revoking Old Lost Keys
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd like to bring up a problem I haven't seen addressed much yet, and which I think is going to come up with increasing frequency as PGP use spreads. The problem is this: how can one spread the word that an old key is no longer to be used when one no longer has the pass phrase, and cannot therefore create a revocation certificate? In my case the problem is medical: thanks to autoimmune problems, I get random memory loss from time to time. Sometimes it's big - like an entire semester of my sophomore year of college. Sometimes it's small - like three old pass phrases. So there are keys of mine floating around the key servers that I don't want used, and which are just taking up space. Others will have more mundane problems, like creating a key years ago and just plain not using it. But as PGP use moves out of essentially pure-geek communities into the surrounded net.world, accidents and other carelessness _will_ happen. I'm curious as to what thoughts, if any, y'all have about how to deal with it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMO4fZH3AXR8sjiylAQHOqwfPbvjHnfM7WlbjjUrrmYQ6Diba2aJb0g2K KjsgTAZ3hyUGcnSBRsMPAb+GTkf440SRvX3JxBsRKn0X0lzHvM6ejKducQPrlJyM ter8C8kiwhZXLcNQiAVpOthrarO7qYqs9JBXmEIm2JwAXtO2SwhB8KsUxvHJpf5R v2036MQb2DSpz1VwmPw6yJYSCy5WrvyT/bRCgJ1Tukx2N0AJ3+tEBeXO9BhpwkjZ oGQPa1XtvcgUGsR1a+HKytz9RrBcgh8voXOBz3LmP1EZH0YEG0VA0a2ej/JUkwza et55dxK8LuuwOz6qo/9QJ2kyGqo641nRLowCdjXI29wITQ== =Asuu -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

Forgetting passphrase/escrow/pgp 3
by Don M. Kitchen 17 Dec '03

17 Dec '03

As has been mentioned, this is a good situation for the use of some kind of escrow. Not meaning to talk about crypto or anything, but it seems to me that there's already some good shamir sharing code out there, I hope the overworked, underpaid PGP 3.0 people put shamir sharing capabilities. I see it as a slight modification of the split/merge code, which PGP already has, plus already written shamir code that hopefully need only be cut-and-pasted into PGP. This is what non-GAK escrow people want, right? Easy-to-use strong-crypto escrow? Don -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Mitnik: latest? -- Long, watch it
by John Young 17 Dec '03

17 Dec '03

Perhaps Brian Davis will comment with the latest but here's Littman on Mitnick (and scans of Shimomura/Media/Feds) through October, 1995: As Tsutomu Shimomura launched his new careers as pitchman, author, movie subject, and video game designer, Kevin Mitnick sat in a Southern county jail. Mitnick wrote to me nearly every week on yellow legal paper in longhand, bemoaning the lack of a word processor as he recounted the hardships of jail. He told me he had been attacked and robbed by two inmates and barely avoided fights with several others. When he complained that the vegetarian diet he requested was limited to peanut butter sandwiches, and that his stress and stomach medication prescriptions weren't filled, he was moved to a tougher county jail. His grammar wasn't perfect, but his writing was surprisingly frank and descriptive. Mitnick punctuated his letters with Internet shorthand, noting the precise minute he began each letter, as if he were still online. He was bitter, but he hadn't lost his sense of humor. When his jailers admitted they'd read the letter Mike Wallace wrote him, inviting him to appear on 60 Minutes, Mitnick admitted the irony of him, of all people, complaining about other people reading his mail. "Poetic justice, eh? ..." Once in a while he'd slip in a tantalizing comment about his case. One week he'd appear to trust me, the next he'd wonder whether I would betray him. It was strange corresponding with the man the media and our government had cast as a twenty-first-century Frankenstein. Mitnick himself didn't seem sure of who or what he was. He asked whether I felt he should be given a long prison sentence. Did I think he was evil? Dangerous? When he was sent to his second jail, as a matter of policy the U.S. Marshals confiscated his books, his underwear, his toiletries. Mitnick was doing the worst prison "time" possible, because the Eastern District of North Carolina had no federal detention center. That meant he would have to defend himself without access to a law library, required by law in federal institutions. The nurse in Mitnick's second county jail cut his medication again, and on June 18, his attorney filed a motion in federal court stating that Mitnick "was taken to the hospital and diagnosed with esophageal spasms." The attorney argued that the "deliberate indifference" to Mitnick's "serious medical needs" violated constitutional standards. Before a federal judge could order a hearing on the medical issues, Mitnick was transferred to his third North Carolina jail in as many months. "He [Mitnick] overextended his welcome," explained a deputy U.S. Marshal in Raleigh who preferred to remain anonymous. "It was time for a change of scenery. This happens with a lot of them. They get where they think they're running the place." Mitnick's third county jail was his worst yet. He shared a cell with seven other men. There was no law library, radio or television, and each inmate was allowed only two books at a time. Mitnick's were the Federal Criminal Code and the Federal Sentencing Guidelines. The eight men in Mitnick's cell were forced to share a single pencil stub that was taken away in the afternoon. Mitnick was allotted one sheet of paper a day. On April 10, 1995, John Dusenberry, Mitnick's public defender, filed a motion to suppress evidence and dismiss the indictment. He argued that the blank search warrants and the warrantless search of Mitnick's apartment violated the Fourth Amendment, which specifically prohibits unreasonable search and seizure. In the government's response, John Bowler, the Assistant U.S. Attorney in Raleigh, defended the blank search warrants, not an easy proposition in a free country. Bowler prefaced his argument by claiming, despite evidence to the contrary, that Shimomura tracked Mitnick on his own until February I4, just hours before his capture. The government's response to the issue of the blank search warrants was to blame Magistrate Wallace Dixon. Bowler asserted that the FBI had wanted to execute the search properly, but the magistrate had "upon his own initiative" insisted on signing the blank search warrants. But a judge never ruled on these arguments. The twenty-three-count indictment the Associated Press had hypothesized could land Mitnick 460 years in jail fell apart. The government abandoned its case in Raleigh, dismissing all but one of the counts in accepting a plea bargain from Mitnick that would likely get him time served, or at most eight months. The tiny story was buried in the back pages of the New York Times. "Kevin is going to come and face the music in L.A., where, of course, the significant case has always been," David Schindler, the U.S. Attorney in Los Angeles, told the L.A. Times. The newspaper said the prosecutor believed Mitnick would receive stiffer punishment "than any hacker has yet received," a sentence greater than Poulsen's four years and three months. Mitnick's letters revealed how Schindler planned to win the record prison term. Schindler was claiming losses in excess of $80 million, the amount that would garner the longest possible sentence for a fraud case according to the Federal Sentencing Guidelines. Nor would Schindler have to substantiate his claim. The government only had to "estimate" the loss. Mitnick's attorneys said the figure was grossly exaggerated, and added that the case rested on source code allegedly copied from cellular companies. There was no proof that Mitnick had tried to sell the code, and there was no evidence it could be sold for an amount approaching $80 million. But under the guidelines the absence of a profit motive was no obstacle to a long jail term. David Schindler was seeking an eight-to-ten-year sentence for Kevin Mitnick, about the same prison time doled out for manslaughter. The jailed hacker wasn't the only one whose feats were being hyped. By August of 1995, the advertisement in Publishers Weekly for Shimomura's upcoming book featured Mitnick's New York Times photo stamped with the caption HE COULD HAVE CRIPPLED THE WORLD. Declared the ad, "Only One Man Could Stop Him: SHIMOMURA." The hyperbole made me flash on what Todd Young had done in Seattle. The bounty hunter had tracked Kevin Mitnick down in a few hours with his Cellscope. Unauthorized to arrest him, he'd kept Mitnick under surveillance for over two weeks as he sought assistance. But the Secret Service didn't think the crimes were significant. The U.S. Attorney's Office wouldn't prosecute the case. Even the local cops didn't really care. When I met Young in San Francisco a couple of weeks after Mitnick's arrest, he was puzzled by the aura surrounding Shimomura and his "brilliant" capture of Kevin Mitnick. We both knew from independent sources that Shimomura had never before used a Cellscope. Young asked why the FBI would bring an amateur with no cellular tracking skills to Raleigh for the bust. If Shimomura's skill was measured by his ability to catch the hacker, then he was on a par with Todd Young, a thousand-dollar-a-day bounty hunter who never had the help of the FBI. The simple, unglamorous truth was that Kevin Mitnick, whatever his threat to cyberspace and society, was not that hard to find. I tried to get the government to answer Young's question about Shimomura's presence. I asked the San Francisco U.S. Attorney's Office and they suggested I ask the FBI. But the FBI had no comment. I asked Schindler, the Assistant U.S. Attorney in L.A., and he didn't have an answer. I asked Scott Charney, the head of the Justice Department's Computer Crime group, and he said he couldn't comment. I asked the Assistant U.S. Attorney who would logically had to have approved sending Shimomura three thousand miles to Raleigh, North Carolina. But Kent Walker oddly suggested I ask Shimomura for the answer. The response reminded me of what John Bowler, the Raleigh prosecutor, had said when I asked him how John Markoff came to be in Raleigh. He, too, had suggested I ask Shimomura. Shimomura seemed to be operating independently. outside of the Justice Department's control. Or was he running their show? The media appeared captivated by Shimomura's spell. Except for the Washington Post and The Nation, most major publications and the television networks accepted John Markoff's and Tsutomu Shimomura's story at face value. Kevin Mitnick's capture made for great entertainment. Not one reporter exposed the extraordinary relationship between Shimomura and the FBI. Most seemed to ignore the conflict of interest raised by the financial rewards Shimomura and Markoff received by cooperating with the FBI. A Rolling Stone magazine story condoned Markoff's actions, saying he had merely done what any journalist would do when presented with the possibility of a big scoop. The media critic for Wired suggested only that Markoff should have advised New York Times readers earlier of his personal involvement in capturing Mitnick. The media functioned as a publicity machine for Shimomura and the federal government, quickly churning out a round of articles arguing for tougher laws and greater security on the Internet. But the fury over what Assistant U.S. Attorney Kent Walker described as Mitnick's "billion dollar" crimes simply distracted the public from the real issues. Privacy intrusions and crime in cyberspace were old news, and a series of Internet break-ins after Mitnick's arrest proved the capture of cyberspace's most wanted criminal had changed little. The real story was that Internet providers, the new equivalent of phone companies on the information superhighway, appeared naive about how to investigate break-ins while protecting the privacy of their subscribers. After an FBI computer child-pornography investigation was made public in September of 1995, the Bureau revealed that it had read thousands of e-mail correspondences, and invaded the privacy of potentially dozens of citizens in the course of its investigation. Privacy activists complained that constitutional rights were being bulldozed, but the FBI announced the public should expect more of the same. "From our standpoint, this investigation embodies a vision of the type of investigatory activity we may be drawn to in the future," said Timothy McNally, the special agent in charge. The government seemed to be promoting a hacker dragnet to make sure the Internet was crime free for the millions of dollars of commerce on its way. Kent Walker, the Assistant U.S. Attorney who left the Justice Department within weeks of Mitnick's arrest for a job with a Pacific Telesis spin- off, was one of the many government officials who claimed the FBI couldn't crack high-tech cases without people like Shimomura. Perhaps prosecutions would increase if the FBI bolstered its force with nonprofessionals. But where would that leave the law and the Constitution? (pp. 368-73)

1 0

Fwd: Undeliverable: Re: Massey, CEO of Compuserve, on Internet
by Steve14571＠aol.com 17 Dec '03

17 Dec '03

Something else I want to know... Why is my mail going through microsoft.com? --------------------- Forwarded message: From: postmaster(a)microsoft.com (Postmaster) To: Steve14571(a)aol.com (Steve14571(a)aol.com) Date: 96-01-05 19:32:00 EST Your message did not reach some or all of the intended recipients. To: goerzenj(a)complete.org Cc: cypherpunks(a)toad.com Subject: Re: Massey, CEO of Compuserve, on Internet Sent: 01/04/96 18:43:35 The following recipient(s) could not be reached: David Tagliani on 01/04/96 18:43:35 The recipient name is not recognized [MSEXCH:MSExchangeMTA:northamerica:RED-70-MSG] Eric S. Hanson (NT RPC) on 01/04/96 18:43:35 The recipient name is not recognized [MSEXCH:MSExchangeMTA:northamerica:RED-70-MSG] Original Message Follows ======================== From: "Steve14571(a)aol.com" <Steve14571(a)aol.com> To: "goerzenj(a)complete.org" <goerzenj(a)complete.org> Cc: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> Subject: Re: Massey, CEO of Compuserve, on Internet Date: Thu, 4 Jan 1996 18:43:35 -0800 In a message dated 96-01-03 00:34:25 EST, you write: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. I see two possible ways to censor German users only (but I still believe censoring anyone is wrong). First, the "main computers" could be told where they are, and "censored" material could be filtered at that level before it is sent to individual users. Or CompuServe could release a software update for German users. The software would not recognize banned newsgroups. How difficult could that possibly be?

1 0

Re: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:10 AM 1/6/96, James Black wrote: >Hello, > >On Fri, 5 Jan 1996, Bruce Baugh wrote: > >> The problem is this: how can one spread the word that an old key is no >> longer to be used when one no longer has the pass phrase, and cannot >> therefore create a revocation certificate? > > If there is someone that you trust (or several people), just make a >revocation certificate and possibly cut it into pieces, and just let >those know when to send it out, so that you don't have to rely on a >faulty memory, and by having it in several hands they can't just send it >out, as they don't know the other people. Just a thought. If one can safely and securely store a revocation certificate for later use, why not just store the much shorter passphrase? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Internet & Porno on A&E tonite
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just saw an add for a Investigative Reports show tonite on A&E dealing with the Internet and some of the current issues relating to porno and privacy. Jim Choate

1 0

Re: Internet & Porno on A&E tonite
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 10:05 PM 1/6/96 GMT, Mutatis Mutantdis wrote: > >>Just saw an add for a Investigative Reports show tonite on A&E dealing with >>the Internet and some of the current issues relating to porno and privacy. > >What time?!? 9:00 P.M. E.S.T. ******************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; E-mail: | - Survive; lharrison(a)mhv.net | - Go to bed." *******************************************************

1 0

Mitnik: latest?
by Mark 17 Dec '03

17 Dec '03

I was curious where Kevin is now and what he is doing or waiting for? Anyone got a timeline of whats in store for him? Cheers, Mark

1 0

(cpx) Re: mental cryptography (fwd)
by David Vincenzetti 17 Dec '03

17 Dec '03

> I have read one paper which attempts to solve this problem, called "Human > Identification through Insecure Channel". Unfortunately my papers are in > a mess right now so I don't have the reference handy. It was by some > Japnese researchers, published in one of the proceedings books. I > believe a follow-on paper was published within the last year or two which > had some improvements or corrections to their algorithm. Sorry to be so > vague, I'll try to dig out more info over the weekend. > > Basically they used a challenge-response system which was intended to > be simple enough that people could do it in their heads. The card > would display a random challenge string, some characters of which were > special to the user and others which he would ignore. He would then > input a response string, where it didn't matter what corresponded to > the "ignore" slots, but in the special slots he had to produce certain > symbols corresponding to the other symbols, with the rules changing as > you move along. The intention was that even by capturing and analyzing a > great many challenge-response pairs you couldn't create a response to a > challenge you hadn't seen before. > > I coded this up, and frankly, I couldn't do the required manipulations in > my head, at least not without taking a very, very long time, and thinking > very carefully. Maybe it would get easier with practice, I don't know. > But my overall feeling was that this would be at the limits of human > capability even for fairly bright people. (OTOH I suppose learning to > read and write might seem pretty tough if you'd never done it. Maybe > the 1st grade classes of the future will spend months training the kids > on how to use these kinds of algorithms.) The paper can be found in the proceedings of Eurocrypt '91, D.W. Davies (Ed.), Springer-Verlag. The author is Hideki IMAI, <tsutomu(a)mlab.dnj.ynu.ac.jp>. I found the above paper very interesting, and I am actually going to code it up. Eventually, I would be highly interested in giving a glance at your code. Is your code available? Ciao, David

1 0

RE: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:47 AM 1/6/96, Frank O'Dwyer wrote: >On Saturday, January 06, 1996 09:18, Timothy C. May[SMTP:tcmay@got.net] wrote: >>Basically, you are screwed. Any revocation you attempt will not be trusted, >>as we will suspect the new "you" to be an attacker, perhaps an agent of the >>NSA or the Illuminati. In the view that "you are your key," the old you no >>longer exists. > >This is true, but the "old you" can be resurrected if you can get enough >people to believe your new key using any out-of-band means available >to you. You can also put a comment in your new key's uid explaining the Could you explain how "enough people" can get around a basic feature/limitation of the current PGP web of trust? Who, besides the originator, can revoke an old key? How many does it take? If a bunch of the "alleged" friends of Bruce could do this, could they not revoke the key of someone they simply wish to hassle? I agree that a new key can be generated, and a new "Please use this key, not the other one" message sent, and this may work, but I don't believe this revokes the old key and removes it from the keyservers. I could be wrong, as I am certainly no expert on the keyservers. The question is: is there a "majority vote" mode on the keyservers that causes them to remove a key if enough people claim it is no longer valid? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FW: Undeliverable: Re: Massey, CEO of Compuserve, on Internet
by blanc 17 Dec '03

17 Dec '03

From: Steve14571(a)aol.com Something else I want to know... Why is my mail going through microsoft.com? ....................................................................................................... There is an email 'alias' at Microsoft which was subscribed to the cpunk list, to receive and distribute the cpunk list to members of that alias. A new beta version of Exchange is being used on a test basis by some departments (apparently all of the cpunks at MS are using it), and the programmers recently encountered a "little complication" (to use a phrase from the movie 'Brazil'). I'm told that the problems were corrected, but that now the spoolers are releasing messages which were backed up while mail delivery was put on hold. I hate to agree with Timothy C. May, but it is probably best to "use technology " to deal with it for a day or so. .. Blanc

1 0

Why can't I get PGP from MIT
by post＠why.net 17 Dec '03

17 Dec '03

MIT won't let me get PGP or PGPhone. I know their server went down awhile back but, I have tried them several times and sent several e-mail requests. I thought maybe I was missing something obvious or maybe they are just really busy. I keep being told I'm not in the U.S. I have tried two different Internet service providers and my Unix account at Lockheed Martin Tactical Aircraft Systems. I understand why I would be denied when trying to get PGP from a commercial site but, under my personal accounts I get the same results. I requested that my providers be put on the "approved" list of domestic sites but still get the same results. My original e-mail request to MIT was sent roughly 3 months ago. All I want is clean copy of PGP for personal use. I have considered purchasing a commercial system but still would like to try PGP with the big keys. Thanks, Sid Post post(a)why.net

1 0

Re: Why can't I get PGP from MIT
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 1/6/96, post wrote: >MIT won't let me get PGP or PGPhone. I know their server >went down awhile back but, I have tried them several times >and sent several e-mail requests. I thought maybe I was >missing something obvious or maybe they are just really >busy. I keep being told I'm not in the U.S. As I recall, they don't tell you you're "not in the U.S.," they tell you they cannot conclude in the affirmative that you _are_ in the U.S. This has to do with whether they have a record (DNS) of your site, blah blah. And the message about sending them e-mail affirming your status, etc., points out that the mail is handled manually and may not be gotten to for a while. This happened to me, with PGPhone, when they could not confirm my ISP (got.net) to be a U.S.-based service. I simply grabbed one of the "otherwise available" copies (it was either posted publically, or available at an offshore site, I forget which). This was several months ago, the day after it was released. I fired it up, concluded I was missing some pieces needed to make it work, and put it aside for the time being. For PGP, I always go to the offshore sites anyway, on principle. These sites are listing with numbing frequency in all the usual places. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Revoking Old Lost Keys
by David E. Smith 17 Dec '03

17 Dec '03

At 11:11 AM 1/6/96 -0800, tcmay(a)got.net wrote: >If one can safely and securely store a revocation certificate for later >use, why not just store the much shorter passphrase? If the security of the safely-stored passphrase is violated, a lot of trouble can be caused. There's not nearly as much that can be done with a stored revocation certificate. dave --- Sorry for any delayed replies, but business trips are so seldom announced. David E. Smith, dsmith(a)midwest.net, PGP ID 0x92732139

1 0

Re: Why can't I get PGP from MIT
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:47 PM 1/6/96 -0600, post wrote: >MIT won't let me get PGP or PGPhone. I know their server >went down awhile back but, I have tried them several times >and sent several e-mail requests. I thought maybe I was >missing something obvious or maybe they are just really >busy. I keep being told I'm not in the U.S. There was a posting (either on the server or somewhere else) that claimed that the MIT site was having problems with .net and .org sites. (As well as a couple of others if I remember correctly.) The posting claimed that they had fixed the problem, but i guess not... | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Re: USENIX anyone?
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 11:31 AM 1/4/96, Matt Blaze wrote: >I'm going to be at the USENIX conference in San Diego later this month, >as are, I suspect, many other crypto/cypherpunk types. > >Any interest in a crypto BOF? I have organized a Remailers and other "Cypherpunkish" topics BOF. I think it is scheduled for Thursday at 6:30 - 8:30 -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Mixmaster On A $20 Floppy?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 06, 1996 12:16:57, 'Laszlo Vecsey <master(a)internexus.net>' wrote: >> >Question 1: Can you fit linux, pgp, mixmaster, etc. on the 135 Mb disk and >> >have enough useful space left over for a useful amount of data? >> >> [snip snip snip] >> >> But if I can squeeze everything I need to turn an arbitrary PC >> into a secure (modulo hardware) login session into 1.44 MB + boot image, >> I don't think there's a problem putting all the stuff you want on a >> 135MB disk. Hell, the _hard disk_ on my Linux box is only 80MB... > >Someone can get one of those tiny devices that slips on the end of a >keyboard connector and captures all the scan codes - you're better off >bringing the whole computer (laptop) along with your floppy. > First, I am not convinced that such devices exist in the real, practical world. They would require either storage hardware or radio transmitters, all in a package small enough to be undetectable to the naked eye. Second, I do not think it practicable that the cosmic-nasties (of one's chosen social bias) could, in the real, practical world, run black-bag jobs on tens of thousands of surburban garages as a prophylactic measure against teenagers "playfully" setting up Mixmaster sites. The software costs of quality crypto approach nil thanks to the terrific folks who brough us things like linux and pgp. It is, I think, easy for us to miss the giantic steps forward that these technologies represent. Imagine talking to an IBM-mainframe priest of not-too-many years ago about the idea of something like linux; imagine the same thing with an NSA bureaucrat about the development cost of a security concept/package like pgp! Move hardware costs downward and user-interface upward, and Mixmaster isn't a "black art" of cypherpunks. It is a parlor game for teenage slumber parties. That's the type of world I want to see. -- -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

1 0

Re: Why can't I get PGP from MIT
by Lou Zirko 17 Dec '03

17 Dec '03

I have sent two requests myselt in the last two months that have gone unanswered. The request was to have isdn.net added to the allowed list. I know the initial rejection was the .net domain, but the location should not be hard to look up - just a basic whois. I got PGP from alternative locations, but still have not been able to get PGPhone. > MIT won't let me get PGP or PGPhone. I know their server > went down awhile back but, I have tried them several times > and sent several e-mail requests. I thought maybe I was > missing something obvious or maybe they are just really > busy. I keep being told I'm not in the U.S. <snip> > All I want is clean copy of PGP for personal use. I have considered > purchasing a commercial system but still would like to try PGP with > the big keys. > > Thanks, > Sid Post > post(a)why.net > > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBLJocAAAEEAMlDzYJPYq0pvfMuSiKU0Y65L2nJql+qEJHYGjO5Pys4prDw YW1ooPWaqrPQAy/eyqrM7I9KNFDCtmaPxtgcPw2oEDfc/w6cPkrVzvovKLfHQvtg V/hHUekptSf6j525omrVAoM9MxVL3sEGCjn9VrTeC3h9upkfntHOJeL88i2NAAUR tB5Mb3UgWmlya28gPHppcmtvbEBkYXRhdGVrLmNvbT4= =Qlxm -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Internet & Porno on A&E tonite
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 6 Jan 1996 10:54:55 -0600 (CST), you wrote: >Hi, >Just saw an add for a Investigative Reports show tonite on A&E dealing with >the Internet and some of the current issues relating to porno and privacy. What time?!?

1 0

"trust management" vs. "certified identity"
by Matt Blaze 17 Dec '03

17 Dec '03

The discussions here of the limits of PGP's certification and revocation model are close to the core of some work I've been doing (with Joan Feigenbaum and Jack Lacy) on what we call the "trust management" problem. Essentially we consider the consequences of abandoning the notion of "certified identity" implicit in systems like X.509 and PGP and subsuming identity under the more general umbrella of specifying and determining what a key is trusted to do. We've built a system, called "PolicyMaker", that allows the certifier of a key to specify what the key is trusted to do rather than to whom the key is trusted to belong. The same mechanism is also used to specify and interpret local policies. The PolicyMaker system is designed to be called as a service by local applications, which could be email systems like PGP or network-layer security protocols or any other application that requires complex trust relationships. Some early, local experience suggests that this approach is a good one. It's easy to specify X.509- and PGP-style policies and certificates, but you can also say things like "valid for transactions over $500 only if countersigned" in a fairly natural way. I'll be happy to send a (very early) draft of our paper, "Decentralized trust management" to anyone who's interested. I've made the draft available in the CFS-users email archive server. To request a copy (PostScript format) by email: echo get cfs-users pmdraft.ps | mail cfs-users-request(a)research.att.com (For non-unix shell people, just send a message to cfs-users-request(a)research.att.com With the line: get cfs-users pmdraft.ps in the BODY of the message (NOT on the subject line).) Comments and discussion appreciated. This is an early draft, and I'd appreciate it if it not be directly quoted, cited, or re-distributed. -matt PS We expect to give away our reference implementation, too. (Probably by May or so.) Note that this is just research, and does not represent any current, past, or future product or service offering on the part of AT&T or anyone else.

2 1

RE: Revoking Old Lost Keys
by Frank O'Dwyer 17 Dec '03

17 Dec '03

On Saturday, January 06, 1996 09:18, Timothy C. May[SMTP:tcmay@got.net] wrote: >At 7:07 AM 1/6/96, Bruce Baugh wrote: >>I'd like to bring up a problem I haven't seen addressed much yet, and which >>I think is going to come up with increasing frequency as PGP use spreads. >> >>The problem is this: how can one spread the word that an old key is no >>longer to be used when one no longer has the pass phrase, and cannot >>therefore create a revocation certificate? > >Basically, you are screwed. Any revocation you attempt will not be trusted, >as we will suspect the new "you" to be an attacker, perhaps an agent of the >NSA or the Illuminati. In the view that "you are your key," the old you no >longer exists. This is true, but the "old you" can be resurrected if you can get enough people to believe your new key using any out-of-band means available to you. You can also put a comment in your new key's uid explaining the problem and how to verify the new key. You will find it very hard to use this new key for a while, though, during the transition period. Many people will take the existence of two keys with the same uid as suspicious in itself, since it at least indicates some kind of attack (even if only a denial of service attack). This is really a usability flaw with current PGP. The PGP formats do allow for a 'revocation' certificate, but PGP doesn't implement it (yet, I guess). In any case, it's not really strong enough, since what it says is "I retract all my previous statements that this key is related to this user". This'd mean that you'd have to visit everyone who'd ever signed your key and get them to issue this retraction. What would be needed for this problem is either an "anti-certificate" ("This key does not belong to this user"), or else some convention. For example, if two _trusted_ keys are found for the same uid, the most recent one could be chosen, and the earlier one be purged from keyservers, etc. This may be possible with current PGP. I haven't tried it, but since I have some keys which have fallen into disuse, I will need to do so sometime.). Cheers, Frank O'Dwyer fod(a)brd.ie http://www.iol.ie/~fod

1 0

please stop the Mitnick stuff
by Perry E. Metzger 17 Dec '03

17 Dec '03

This is cypherpunks, not Mitnick punks, Shimomura punks, or anything similar. I personally don't care about Kevin Mitnick, and he most certainly has little to no cryptography relevance at this point. Take it elsewhere. Perry

1 0

RE: Revoking Old Lost Keys
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Perhaps if keys could be made with expiration dates (certificates too), this problem might be reduced to managable proportions. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: please stop the Mitnick stuff
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 06:31 PM 1/6/96 -0500, Perry Metzger wrote: > >This is cypherpunks, not Mitnick punks, Shimomura punks, or anything >similar. I personally don't care about Kevin Mitnick, and he most >certainly has little to no cryptography relevance at this point. Take >it elsewhere. C'mon, Perry, give it a break. Mitnick's case has to do with security issues as well as the violations of privacy and/or search and seizure the government used to arrest him. It may not be cryptography per se, but are you going to seriously argue that security, etc. is not encompassed in crypto issues? I found it interesting. If you didn't, then all you had to do was delete it. No one needs to read your personal crusade as *The One* who tells us what's relevant and what's not.

4 3