December 2003 - cypherpunks-legacy

Heaven's Cypherpunks
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

If you like weird connections, how about a Cypherpunks-Heaven's Gate link? If you like really weird connections, how about a Cypherpunks- Heaven's Gate-Solar Temple link? If you like really, really weird connections, how about a Cypherpunks-Heaven's Gate-Solar Temple- Waco link? Lest you think I jest, let me explain that what I am about to tell you is fairly easy to verify and document, and is not based on vague allusions to some psychic vibrations from the comet, which seem to be rather commonplace lately. In the early 1970's there was a small group in Canada, known as the Bartonian Metaphysical Society. The group was joined by an individual named C.J. Parker, who had just had his first experience of "the end of the world" as a member of Herbert W. Armstrong's Worldwide Church of God. Parker became a teacher and leader in the group, which soon became the Institute for Applied Metaphysics, with metaphysical retreats in Saskatchewan, Ontario and Quebec. There were often UFO reports surrounding the dates of their intensive seminars in Eastern Canada, which received press coverage, I believe. Parker was involved, according to both himself and many others, in the founding of the New Covenant Club during his involvement with IAM. This was centered around the belief that the "old covenant" with God, which involved circumcision, had now been replaced with a "new covenant," which involved vasectomies. Later, some of the Eastern leaders began indicating that if vasectomies were a good way of indicating one's dedication to spirituality in the end-times, then castration was even better. Parker was soon involved in a second "end of the world" when Winifred Barton made her prediction in the mid-to-late 1970's. After her prediction appeared (to some) not to come true, then many left the group and quite a few migrated to other groups, including the Solar Temple. Parker migrated to Texas, where he was involved in the music business, and in running clubs for mob interests. He managed clubs in Waco and Killeen, Texas, where he apparently became involved with David Koresh, although that might have been at a later date. He was arrested and convicted in Bell County, Texas for assault on police officers there, sometime around 1980. Parker became a recording artist and soon afterward moved to Tucson, Arizona, where he continued to dabble in music and metaphysics, travelling across the SouthWestern U.S., as well as up and down the west coast. He started a computer company in Tucson, called "Pearl Harbor Computers," which was based on the belief that computers were the work of Satan, that Bill Gates and Microsoft were tenacles of the Satan, and that those who wished to fight evil must dedicate themselves to promoting other operating systems, UNIX in particular. Parker apparently fathered an organization called the "Circle of Eunuchs" that was dedicated to recruiting individuals who had the skills and the intelligence to develop systems and methodologies which could serve to work against what he saw as the plans of Satan to bring domination over the whole earth At various times, he has had vehicles registered in the states which were his main recruiting area: Texas, Arizona, California, New Mexico, and Oregon. (He also made limited recruiting trips to Germany, Poland, and, I believe, Russia.) Parker spent time in California where he was in contact with Do, who shared his fetish for mixing computers and spirituality, and it was apparently Parker who introduced him to the concepts underlying the New Covenant Club. Parker and Do also shared an affinity for mixing spirituality and alien theories, and decided that the Internet was going to be the battleground of the future in the fight between good and evil. Parker was also involved with a group in Berkeley, California, Basis, Inc., which was heavily involved in a Unix time-sharing enterprise and gave Parker access to a wide variety of young students and programmers to introduce to his belief system. Parker named the evil protagonist in the manuscript after the login name for one of Basis' founders, "Gomez." Parker wrote the book under the pseudonym of "son of gomez," as Basis' Gomez was his mentor in the world of UNIX. Parker was responsible for a manuscript titled "The Xenix Chainsaw Massacre" that contained a character, Bubba Rom Dos, which was loosely based on Do, including veiled references to his sexual inclination toward youngsters. Among those in the Circle of Eunuchs, it was also referred to as Part I of "The True Story of the Internet," which they foresaw as the vehicle that would prove the manuscript prophetic. Parker and his tenacles used the Internet to quietly spread the manuscript among those thought to be potential recruits, even as Do's group began making their impact on the Internet. Parker believed that Phil Zimmerman's troubles were a result of his group using Zimmerman's PGP to spread the manuscript secretly across the Internet. He apparently impressed upon Do the need to use PGP to secure any communications which were of a nature that they could cause undue trouble for groups which were working against Satan and Gates. Parker's second manuscript, Part II , began as "TV World" and later was changed to "WebWorld and the Mythical Circle of Eunuchs." This manuscript was apparently supposed to be converted to hypertext, with complete graphics, by Higher Source, and several chapters were in the works, but about a week before the El Rancho suicides, Parker was told that he should go ahead and release it in its present form, because Higher Source would not be in a position to complete the work. Parker began converting the second manuscript to hypertext himself and has had members of his organization releasing it on the Cypherpunks list. Chapters of the manuscript have been released from various points in the U.S., Canada, the U.K., and Russia. Although the manuscript had already been completed around a year before this, Parker, after receiving word to begin its release, began making _changes_ in the manuscript, apparently as a result of no longer having a need to so heavily disguise the connection between the Circle of Eunuchs and Do. A prologue was written for "WebWorld," sent to the Cypherpunks list on March 18, 1997, in which the opening strains contained the quote, "Why didn't I _do_ something?" The word "do" was in bold hypertext. Then, the next word in bold format was the word _me_, indicating that the first bold word should be pronounced as in the musical notes, do, re, me. The sentence containing the world _me_? It was a reference to Do soon being 'picked up,' "This time, they are coming for _me_." And the new opening sentence of the manuscript? A veiled reference to the fact that those left behind had been warned of their last chance to 'escape' the fate that awaits them. "The great tragedy of it, is that it didn't have to happen. Not at all... we were warned." The URL's of the manuscripts are: http://bureau42.base.org/public/webworld/ http://bureau42.base.org/public/xenix/xenbody.html They are apparently hosted by David E. Smith <dsmith(a)prairienet.org> I don't believe that he is a member of Parker's inner circle, although he does have many connections to hackers and phreaks in the Edmonton, Alberta area. Except for the prologue, the sections of the original manuscript seem to be in small print, with the newly written sections in large print. The new sections appear to use the Cypherpunks as analogous to the space aliens, and a new character, Jonathan, representing one of the Heaven's Gate members, is added. "He rode the river of tears once again, only this time the journey was _toward_ the CypherPunks, and toward freedom." It is my understanding that the "Magic Circle" is quite active in both Western Canada and the Southwest U.S. They seem to be a very secretive organization with ties to a number of groups, including the Solar Temple cult in Quebec, and a Diamond System (?) Freudian-Sufi sect centered in the Bay area. I dropped all involvement with these people a year or so ago, as I decided that involvement with them is unhealthy. I hope that you will make an effort to check out what I have told you, and perhaps expose any activities which could lead to more deaths and castrations. I don't want to be involved with anything further to do with them, as I am uneasy about being connected with them in any way, shape, or form, although I still keep track of their activities through certain members who are on the periphery of their organizations. C.J. Parker is a nome-de-plume he took on as a musician, and I can't recall his real name, but it shouldn't be too difficult to find, given the fact that he has a criminal record in the U.S. which should link the pseudonym with his birth name. He also might be located by tracking him through his record releases, which were done in Canada, I believe. TruthMonger

2 1

Re: PSYOPS/infowar
by jim bell 17 Dec '03

17 Dec '03

At 10:47 PM 3/29/97 -0500, Robert Hettinga wrote: >This is surely going to piss some people off, but let's some fun with this, >shall we? > >At 9:30 pm -0500 on 3/29/97, Greg Broiles wrote: > >> According to Ronald Duchin, graduate of the US Army War College and >> former special assistant to the Secy of Defense and director of the >> Veterans of Foreign Wars, activists fall into one of four categories: >> radicals, opportunists, idealists, and realists. He recommends a >> three-step strategy to neutralize activists: >> >> 1. isolate the radicals > >Tim May >Kelly Goen >Phil Zimmermann (then) >Belize, say I'm PISSED! Ya forgot me!!! B^) Jim Bell jimbell(a)pacifier.com

2 1

Re: Money Laundering Conference
by Robert Hettinga 17 Dec '03

17 Dec '03

At 12:13 pm -0500 on 3/30/97, Black Unicorn forwarded to DCSB: > This is a formal invitation to you to attend the upcoming 8th > International Oceana Conference on Money Laundering, The Caribbean & Latin > America, Cybercrime, Financial Crytography and International ^^^^^^^^^^^^^^^^^^^^^ Wonder where they got *that* from? :-) > Financial Crimes on May 6-7, 1997 at the Sonesta Beach Resort and Casino > Curacao, Curacao, Netherlands Antilles. This conference sponsored by > Oceana Publications, Inc. in cooperation with the > Association of International Bankers of the Netherlands Antilles (IBNA), > The Association of the Compliance Officers of the Netherlands Antilles > (CONA), and the Centre for International Financial Crimes > Studies, College of Law, University of Florida will provide global and > regional coverage of Money Laundering and International Financial Crimes. > > > (See, http://www.oceanalaw.com/seminar/ml2toc.htm) Hey!!! There's an *echo* in this room. What's the propagation delay here? Say, what, 3 months? Sheesh. Don't ever look behind you. They might be gaining... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

WebWorld 21
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

WebWorld 22
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: National Citizen-Unit
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> Governor's Budget Includes Money to Set Up Gang-Tracking In> Network In> [...] In> [A]s part of the governor's anti-gang proposals, he's In> proposing to spend $625,000 worth of state and federal money In> to set up a gang-tracking computer database and network. In> Four agents of the Tennessee Bureau of Investigation will be In> assigned to do nothing but gather and maintain information In> about gangs in the state's four regions. <snip> In> Information on the database could include a picture, a In> description, the gang affiliation, criminal convictions, In> crimes that a person is suspected in, and possible In> nicknames. -=> Quoting In:bdolan@usit.net to Harka <=- In> The important thing to note is that - as I understand the In> description of the program - a person does not have to commit a In> crime to be included in the database. They just have to have In> contact with a person or group which is already in it. This has been going on in Germany for several years now under the name "Raster-Fahndung" (cross-reference-search). What it means is as you write it: even mere contacts to suspected "terrorists, gang-members, drug-dealers" etc. is enough, to get you flagged as "suspected supporter of [see above]". An example of how one could get into that was being presented by a german civil liberties group: Let's say, there is a non-permitted demonstration going on in City A of "anarchic chaots" (the german term for ultra-left-wing groups). The police installs street barriers around the city and screens the drivers licences in search of potential demonstrators. Bob drives up, shows his ID and happens to be believed by the police man to be somehow affiliated with the demonstration. They might search his car and will let him go after that, if nothing is found. However, his name will be put in a central database as "suspected supporter of unconstitutional groups". That is enough to target his entire family and close friends with possible surveillance etc., if the police (or actually the interior intelligence agency "for the protection of the constitution") chooses to. Bob will never know of that and although, he has nothing to do with the demonstrators, his name will be in such a database as a suspect. That example shows, that the law can be (mis)used to almost unlimited surveillance on pretty much everybody to the hearts extent of the "law-enforcement" agencies. And guess what? They will. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMz83nTltEBIEF0MBAQGNnwf8CL7L2pEY1Qfnfh+5D5LWwTb/DXWAr6+C TJcsuBYA8MQ94tNhM7DDwBLlf60AKVgKJjh/BX6JEOWMrXLXewkDxNCj9PG1iDwV bPXmEsI8ovX8EZJrNjFAhF7pG83bwHzD+23xpamx+9fYq6T2hHpZse7XEavYNBqv 0+8vJiCxsvuLn9q8CWng+KgNYmCk9JXJUj+8jUvJJHgbXt+Bkvech4mfL7cW7nvN HPAMXalKWaWrcroJAnz/2bi2JlMovfVftU1u79CUrPi9rPMYJJAaD28VEfeCHd5T e9WfTnu6F3C67CEZ0TCR+toQxLM5RgNej3mv69OiVyntNnmaPD9GeQ== =1e2d -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

2 1

National Citizen-Unit #22
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

WebWorld 22

1 0

rot13 Encoder/Decoder
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

http://otto.cmr.fsu.edu/~davis_t/rot13.cgi

1 0

Privacy? Not in Canada!
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

From: ag434(a)freenet.hamilton.on.ca (David Buchanan) Newsgroups: alt.security.pgp,talk.politics.crypto Subject: Re: If you want privacy, don't come to Canada! Date: 30 Mar 1997 22:26:41 -0500 Organization: Hamilton-Wentworth FreeNet, Ontario, Canada. CRIMINALS WON'T BE THE ONLY TARGETS Criminals won't be the only targets if strong non-escrowed encryption is outlawed although criminals provide a convenient excuse for governments seeking to extend their power over their own citizens. Even in Canada, a nation which can hardly be described as a police state, there is good reason to fear the security and intelligence apparatus will be used by the government against its legitimate and law-abiding political opponents. Let me give you two examples. 1) BUREAUCRAT'S "LET'S GET HIM" MEMO Within the last couple of weeks, the Canadian public learned from news reports about a meno written by a top level federal bureaucrat in which he complained about the activities of a private citizen and suggested that his fellow government officials should "take a look at this guy." The private citizen was a law-abiding, former military officer whose freedom of information requests had exposed mismanagement and corruption in the government. This memo was particularly chilling because the recipients included officials of the tax department and the Canadian Security and Intelligence Service (CISIS) -- two agencies well suited to bringing pressure to bear on private citizens. Although the bureaucrat was caught in the act this time, it is quite disturbing that a senior civil servant believes such a memo to be normal and acceptable. 2) NEO-NAZI PLANTED IN OPPOSITION PARTY During the last Canadian federal election, the ruling Progressive Conservative Party (PCs) was losing voters to the Reform Party, a moderate, small "c" conservative party based in Western Canada. The PC's campaign strategy was to accuse Reform of being "extremists" or "racists." About the only evidence of this that the PCs were able to produce was the founder and leader of a small neo-nazi style group who had attempted to infiltrate the Reform Party with little success. Subsequently the public learned that the neo-nazi was actually a paid agent of the Canadian Security and Intelligence Service (CISIS), an agency ultimately controlled by the Progressive Conservative government. There have been the expected denials from CISIS but the most plausible interpretation of these events is that the Progressive Conservative government tried to sabotage the electoral chances of the Reform Party by planting a neo-nazi on its fringes. CISIS is one of the government agencies that definitely would have access to all of the material obtained from the proposed key escrow or key recovery type systems. WHY HONEST CITIZENS SHOULD BE WORRIED The increasing use of email and other data telecommunications will greatly expand the amount of private and personal information on private citizens that governments can collect, archive, and sift through whenever they need weapons to use against their legitimate political opponents. This information can be collected very cheaply and used in ways that are difficult for the government's victims to counter or even detect. For example, a simple telephone call to a cooperative bank official just before the a target attempts to renew a line of credit for his business. The only effective way to prevent this is with the wide availability and use of strong non-escrowed, non-key-recovery encryption. As for those trusting souls out there who still believe they have nothing to hide, ask yourself this question: Would you be willing to email carbon copies of all your email messages and online data transmissions to one of your political opponents? If secure encryption is banned, this is exactly what you will be doing and you had better be prepared to agree with everything the government does on every issue or take the consequences! DB --

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 31 Mar 97 6:49:14 PST remailer email address history latency uptime ----------------------------------------------------------------------- hidden remailer(a)hidden.net **######.### 51:35 99.99% lucifer lucifer(a)dhp.com ++++++++++++ 36:24 99.98% cyber alias(a)alias.cyberpass.net *+**+++*+++* 38:16 99.91% weasel config(a)weasel.owl.de ++--++-++++ 2:21:10 99.89% replay remailer(a)replay.com **-**-+*-+-* 1:32:14 99.81% balls remailer(a)huge.cajones.com ###+*##* +## 2:27 99.73% squirrel mix(a)squirrel.owl.de ++--++-++++ 2:44:37 99.58% dustbin dustman(a)athensnet.com + ++ +-++ + 49:04 99.35% exon remailer(a)remailer.nl.com #*+# +##* ** 4:34 99.25% reno middleman(a)cyberpass.net +-++ +.-+- 50:50 98.87% winsock winsock(a)rigel.cyberpass.net -----+---- - 3:56:33 98.65% jam remailer(a)cypherpunks.ca * ** ** * 11:13 98.54% extropia remail(a)miron.vip.best.com ___.._.-.- 27:38:30 96.60% mix mixmaster(a)remail.obscura.com ___.+_.-* 33:58:31 94.45% shaman remailer(a)lycaeum.org ++-++-+ -+ 28:03 86.87% nym config(a)nym.alias.net ***#**-#-# 13:11 80.62% haystack haystack(a)holy.cow.net 52:19 -4.36% middle middleman(a)jpunix.com + 35:43 2.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Stego Question
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Stego Question: How many bodies does it take to spell, "I _told_ you I was crazy!"

1 0

Re: PRESS REPORT - IMPORTANT?????
by Ray Arachelian 17 Dec '03

17 Dec '03

Is this for real or a troll??? On Mon, 31 Mar 1997, Anonymous wrote: > *** London Times, 30/03/1997 *** > > >Factoring problem broken: > > > >One of the main systems used by computer privacy > >programs around the world such as those used on > >the internet to prevent third parties eavesdropping > >on credit card transactions has been proven insecure, > >The RSA algorithm, based on the difficulty of "factoring" > >large numbers appears to have a weakness, a press > >release by the IACR (International Association for cryptologic > >research) reads as follows: > > >"Leading researcher Ari Lenstra last night announced major > >progress had been made towards a solution to the factoring > >problem, a result obtained by Sergei Ripov, researcher at > >an obscure university in the former Soviet union, shows > >conclusively that there exists a solution to the problem > >that is of polynomial time complexity, although this solution > >has yet to be found this signals the beginning of the end for > >a number of cryptosystems based on this problem, please note > >a trivial solution to factoring also suggests a trivial solution > >to the ECDLP and therefore a number of other systems such as > >Diffie-Hellman and the El-Gamal group of cryptosystems should > >be considered insecure" > > > >We were unable to contact the IACR for futher information. > >The leading internet products company Netscape refused to > >comment saying only "We regularly review data security > >issues concerning all of our products". > > =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Re: [NTSEC] Re: Internet Explorer Bug #4 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die. ---------- Forwarded message ---------- Date: Sat, 29 Mar 1997 14:37:43 -0800 From: Chris Plunkett <chris.plunkett(a)opensys.com> To: pmarc(a)cmg.FCNBD.COM Cc: Romulo Moacyr Cholewa <rmcholewa(a)poboxes.com>, Windows NT BugTraq Mailing List <NTBUGTRAQ(a)rc.on.ca>, "ntsecurity(a)iss.net" <ntsecurity(a)iss.net>, hughtay(a)microsoft.com Subject: Re: [NTSEC] Re: Internet Explorer Bug #4 > > We are aware of this, but the report is misleading. The report states > > that both times the password sent from the client to the server is > > encrypted. It would take quite a while for even a Cray Supercomputer to > > decrypt the password, even if it was dedicated to that sole task. For > > the average network server (and a powerful one), it would take a few > > human lifetimes to decrypt them even if they were dedicated to that sole > > task. > > Arrggghhh! Nothing sets off my ignorance alert more quickly than somebody > who mentions a Cray in conjunction with attempts to brute force crypto > algorithms. I won't bother to explain all of the reasons why that is a > foolish thing to say. Instead I will share a little story about some folks I > know from about 3-4 years ago. (Greetings to any of these individuals who > may be lurking on NTSEC or NTBUGTRAQ.) > > Apparently they had some good reasons to go after the encryption algorithm > used by WordPerfect. After several ineffective implementations, a > WordPerfect engineer developed a DES based encryption algorithm. His claim > was that it would take a room full of Crays to break the algorithm. Hmmm... > sounds familiar. Needless to say, shortly after a successful attack on the > algorithm by those mentioned, there was a certain 486 with a YMP sticker > plastered to its front. > > Sure, brute force attacks can be expensive when an algorithm is implemented > correctly. However, I can't let it pass when these facts are expressed in > such a patronizing manner. > > --- > Paul M. Cardon - System Officer > Capital Markets Systems - First Chicago NBD Corporation > pmarc(a)cmg.fcnbd.com - (312) 732-7392 > I heard a story one time. It evolved around a college student in France doing some cyptography work in school, working nights as a backup operator at some large computer center. He didn't need a cray. A little knowledge and some creative programming, and a center full of computers (problably around the size of a Sparc 10). The story ended explaning how one of the encryption schemes that would tale a Cray week to break, was broken in one night, by a bunch of computers running backups. It might be hard to find a cray, but I know a guy, he works at this place where they got them 15 pentium pros. The average network server has another server for some other task on the same wire. ------------------------------------------------------------ Chris Plunkett System Technician Breakwater Technologies Inc. phone:(206)803-5000x112 Fax:(206)803-5001 http://www.breakwater.net mailto:chris@breakwater.net ------------------------------------------------------------

2 1

Re: PRESS REPORT - IMPORTANT
by Toto 17 Dec '03

17 Dec '03

Huge Cajones Remailer wrote: > > Anonymous writes: > > > > *** London Times, 30/03/1997 *** > > > > >Factoring problem broken: > > > > > >One of the main systems used by computer privacy > > >programs around the world such as those used on > > >the internet to prevent third parties eavesdropping > > >on credit card transactions has been proven insecure, > > >The RSA algorithm, based on the difficulty of "factoring" > > >large numbers appears to have a weakness, a press > > >release by the IACR (International Association for cryptologic > > >research) reads as follows: > > A little early for April Fools'. "Sergei Ripov" indeed. I did a search through the online edition for anything to do with encryption, RSA, algorithms, etc., and nothing came up for the last few months. Maybe it's in the April 1st edition. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Ray Arachelian 17 Dec '03

17 Dec '03

On Thu, 27 Mar 1997, Kent Crispin wrote: > > The PGP web of trust idea is more than sufficient. > > No, it is completely inadequate. I am the office-supply manager the > San Francisco branch of Big Well-known Company, Inc. I have > signature authority in the company for purchases up to $5000, > otherwise I have to get higher-up approval. I have a "company > signature" which is authorized for that amount, one of about 800 such > signatures. I wish to purchase office supplies from a large office > supply wholesaler in New York, which has literally tens of thousands > of customers. The "web of trust" model simply does not handle this > kind of situation well. I realize that some of the keyservers are > very high performance -- that's not the problem. The problem is the > structure of the web itself. If there were some trusted *authority* that > could sign keys... Sure there is. The HR department of Big Well-known Company, Inc. can sign the employee's keys. What's the problem? If you want to order something you do so by generating a P.O. or by using a credit card. What does the web of trust have to do with this? If you need approval, it's simple, you ask for it. When you get it, you order your 10,000 pencil erasers. You don't have to use PGP signatures for orders, but you can if the infrastructure is there between both companies. > > If you > > want, you can designate a third party as a trusted > > authority. However, this is not needed if you meet > > the person with whom you will communicate in person > > and exchange public keys. Further this trusted > > authority needn't be a government entity thank you. > > This could easily be your lawyer, Verisign or some > > other entity. > > This is no longer a web of trust model, it is a Certificate Authority > model. Certificate authority standards are developing at warp speed. No shit. Both are possible. Whichever your company wants it will use. > > The only legal support needed for digital signatures > > is for the courts to recognize that digital signatures > > are equivalent to their analog counterparts. > > The *only* legal support? This is a *big* deal, and the issues are > very complicated. Handwritten signatures and digital signatures are > really quite different. I claimeth not lawyerhood, but IMHO, it can stand up in court if both parties agree to it by analog signatures infront of a notray. Any lawyers care to comment? > > This could > > be binding if the two parties sign something that says > > "If I use PGP to sign a document I agree to allow that > > document to be treated as if I signed it." (IMHO) > > Sure. It's been done, in fact. However, pairwise contracts with > everyone you do business with is not going to cut it. You need laws > for this. Not if it is agreed by all parties involved and their lawyers to honor such signatures. (IMHO) > [...] > > > > > 4) Businesses, especially large businesses, will (and do) > > > want common standards for key and DS management. > > > > Yeah, and they also want standards for software. I.e. > > Word Perfect Office versus Microsoft Office. Lotus > > Notes Domino versus Netscape Enterprise server. However > > neither of these examples show a need for government > > entities. They can easily say "We use PGP as our > > signing standard, and our notary will be shown > > a person driver license and will sign a printed email > > with that person's key for proof." > > This is pair-wise contracting again. Note, incidentally, that > standards concerning signatures are of a different order than > standards concerning office software. There far more pressing > liability issues with digital signature. Really? you must not have been gotten infected by the slew of Word and Excel viruses out there. Might be a very good lawsuit against Micro$oft that they allowed such things to happen. Standards for a company are standards for a company. Which standard has more weight or importance is up to that company. Sure, it is on a bigger scale that installing XYZ OfficeWare and getting your ass fired, but it is still a standard. Is there any reason that a specific company CAN'T decide to use PGP? (or PEM, or some other scheme) if it so choses? > > > 9) There is a high probability that a widespread standard > > > for enterprise level key management including key escrow > > > will develop in the next few years. > > > > Why jump to key escrow all of a sudden? You see, a > > corporation can escrow its own keys in a fire proof > > safe off site. Why use a government agency where any > > two bit crooked employee can access the keys of that > > corporation? > > I didn't say "government agency". I said "Enterprise level". A > fireproof safe offsite is indeed a crude form of enterprise level key > escrow. But it's not really very useful. Imagine a company with > several thousand employees, with each employee having a company > signature key. You use your key for all kinds of mundane things -- > signing your time sheet, signing purchase orders, signing memos, > etc. (This is not one of your personal keys that you use when you > send email to your lover.) You have a turnover of several people a > month, people forgetting passphrases, people invalidating keys > because of a passphrase compromise, etc. These are company signature > keys, also used for encrypting email, so the company escrows all the > secret halves of the keypairs. (There is no privacy issue here -- > these are all company keys used for company business, all the > encrypted documents are company documents.) So what's the problem? You hire people to keep track of assigning, escrowing, and signing keys for your employees. You have IS staff and security staff to watch for breeches. You can automate tons of this with good written scripts that automatically scan all email for valid signatures and raise alarms when signatures don't match. Where is this not useful? For a small company a locked safe is plenty. For a large company, you hire HR/Security folks to be your "Key Agents" or whatever. > In this scenario there is daily access to the key escrow system. A > fireproof safe offsite is not the most convenient way to deal with > the problem, and so the company will buy a software solution -- a > nice, cryptographically secure, software solution. (This is > obviously not a hard problem -- any cypherpunk should be able to > design such a system.) Yeah, ditto. We agree on this. We also would want something sent offsite incase of nuke, flood, fire, or mass suicide. :-) (sorry had to throw in a Heaven's Gate ref somewhere.) > > > 10) This will converge with legal developments motivated by > > > Digital Signature and support for electronic commerce, so that > > > the standards will actually be government standards with at > > > least partial force of law. > > > > Why do commercial standards need be the same as those > > dictated by govermental standards? > > Many commercial "standards" are legal standards, supplied by the > government. In fact, the whole legal infrastructure of business law > is really, when you get right down to it, a set of legally mandated > standards. Standards are all over the map, when it comes to legal > status. Because there are laws that force such standards on the company. So far are there any laws that say you can't use anything but DSA? (Or Clipper, or whatever NSA backed scheme d'jour is being pushed?) If there were such laws in progress, they would be fought. :) > > Why does there need > > to be a law that says "All businesses MUST use clipper > > (or whatever) and escrow keys with the FBI/CIA/etc.?" > > There doesn't need to be such a law. So we agree. :) > [...] > > Sure, hence the old "When encryption is outlawed only outlaws will > > encrypt" slogan. Why do we need laws to state what a company is > > allowed to encrypt or not encrypt? And why must those state > > what cypher, bit lengths, and methods they must use? And that they > > must be escrowed in a certain way? > > How about a law that stated that all RSA keys used for digital > signature must be at least 4096 bits in length before they will be > accepted as legally binding? Would that be a good law or a bad law? It would be cool by me to impose a minimum provided that the current state of hardware could process such keys without too much of a delay factor, but not a maximum. If I am sick enough to want a 16384 bit RSA key, why force me to use something lesser? But within a company, were I insistent enough for whatever reason to use 384 bit RSA keys, as weak as they are and that was my company's policy I should be able to allow it. (Just as employers can read email if you expect that you have no privacy on the company email system.) > > Where I work, we keep in "escrow" a key database (on index cards) > > with all the passwords for all the machines. Also in that fire > > proof safe live all the backups. > > Funny, we do exactly the same thing. Except once a year or so > complete backups are carted off to the desert, and stored > forever. Ours is a bit more paranoid. We offsite a tape on the 15th and last day of every month. Every few months we burn a pair of CD's of the important stuff, keep one in the local safe, one offsite. > > Yeah, and likely you should change your underwear since it is soaked in > > it. :) > > Over the years I've developed an asbestos butt. It helps (looking at my own flame resistant shorts...) =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Looking for a c'punk volunteer in the East Bay
by John Gilmore 17 Dec '03

17 Dec '03

Date: Fri, 21 Mar 1997 17:54:11 -0800 (PST) From: Dennis Derryberry <dennis(a)eff.org> To: gnu(a)toad.com John - do Cypherpunks like to play superhero and help people who are being hacked? A woman called who says someone had rboken into her system reprogrammed certain controls causing her to be instantly trackable whenever she logged in, no matter what account she used, no matter from where, etc. She says it happens *every* time. Law enforcement is baffled and has no advice (surprise, surprise). She said the FBI even recommended she hire a hacker to play along with the culprit and see if they couldn't catch him that way. So, if you or anyone you know is interested in a weekend sporting event, you can reach Debra Wellman at the home of her mother 510 855 9744 I spoke with her on the phone. She is not crazy, just frustrated. Dennis -- Dennis Derryberry Executive Administrator Electronic Frontier Foundation Web: http://www.eff.org tel: 415 436 9333 x104 fax: 415 436 9993 email: dennis(a)eff.org

2 1

Re: PRESS REPORT - IMPORTANT?????
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:05 AM 3/31/97 -0500, Ray Arachelian wrote: >Is this for real or a troll??? > It's not in *my* copy of the Sunday Times. Sounds like the Russkies haver broken RSA" trolls we've seen before. It's a 'Ripov'. DCF

1 0

The Zimmermann Telegram
by Alec 17 Dec '03

17 Dec '03

>Date: Mon, 31 Mar 1997 11:59:49 -0800 >To: telegram-request(a)pgp.com >From: Dave Del Torto <ddt(a)pgp.com> >Subject: The Zimmermann Telegram > >-----BEGIN PGP SIGNED MESSAGE----- > > >Ladies, Gentlemen & Cryptographers, > >I'm pleased to announce the imminent release of the premier issue of the >new "Zimmermann Telegram" newsletter. The Zimmermann Telegram will be a >regularly-published, paper-based, English-language technical update >newsletter from PGP's engineering staff, and will cover a variety of >cryptographic and other lighthearted topics which we may otherwise be >restricted from discussing via electronic media. The newsletter will be >sent, in compliance with US law, by regular postal mail to anyone >interested in technical information about PGP -- anywhere in the world. > >If you are now developing PGP-related freeware, shareware, commercial or >academic cryptographic software, or you plan in future to become a >registered PGP Developer or PGP World Partner (those programs are currently >under construction and will be formally announced later) or if you are just >interested in technical information about cryptography, we think you'll >enjoy reading our newsletter. > >In the premier issue, along with important updates regarding changes to the >PGP packet format, CRC security problems and new extensions to the PGP key >format which are not available through any other medium, you'll learn about >the significance of the "Zimmermann Telegram" name. Meanwhile, visit this >page: <http://www.nara.gov/nara/digital/teaching/zimmermann/zimmerma.html>. > >Scheduled to be mailed imminently, the premier issue will be sent free to >anyone who provides us with a postal mail address. After that, regular >subscriptions will require a modest fee (to be announced) to cover our >mailing costs, but we've committed to offering a limited number of free >one-year subscriptions to interested members of the cryptography community. >To request your free subscription, please send email to me at: > ><mailto:telegram-request@pgp.com?subject=first_issue_free_subscription_req> > >In the body of your request, please include the form below (items between >the cut-lines ONLY, and preferably PGP-signed), and replace the lines with >your complete postal mail address info as indicated. We'll put an HTML >subscription form on our website, but for the premier issue, we're managing >the subscription process via email. Thank you for your patience as we >deploy rapidly. :) > >............................. form begins here ............................. >The Zimmermann Telegram >PGP's Technical Newsletter > > - Premier Issue & One-Year Free Subscription Request - > >Subscription Information (Premier Issue): > > name (optional, but appreciated) > title (optional) > organization/dept (optional, as appropriate) > street address > mailstop (optional) > city/state/province > zip-/postal-code > country > >Free Subscription Category: (please [x] only one) > > [ ] academic > [ ] public library > [ ] media maven > [ ] human-rights/privacy activist > [ ] corporate security > [ ] impoverished cypherpunk > [ ] software analyst > [ ] law enforcement > [ ] freedom-fighter > [ ] intelligence agency > [ ] freeware developer > >.............................. form ends here .............................. > >Privacy Lock: If you are concerned about the privacy of your personal >information when sent over unsecured public networks, please feel free to >encrypt your subscription request to my key, which can be found at: ><http://swissnet.ai.mit.edu:11371/pks/lookup?op=index&search=0x4AAF00E5>. >Pretty Good Privacy Inc will take all reasonable precautions to protect >this information and will not use it for any other purpose without first >asking your permission. Also, PGP will not sell or give the information to >another entity and will store the list securely between mailings. > >Please feel free to circulate/forward this message (with PGP-signature) >among your friends and colleagues (remember: the free subscription offer >expires on 30 April 1997). We look forward to your comments on The >Zimmermann Telegram and thank you for your continued support of PGP. > > > dave > >_________________________________________________________________________ >Dave Del Torto +1.415.524.6231 tel >Senior Technical Evangelist +1.415.572.1932 fax >Pretty Good Privacy, Inc. http://www.pgp.com web > X-PGP header key > > >........................ "The Zimmermann Telegram" ........................ >Copyright © 1997 Pretty Good Privacy, Inc. All Rights Reserved. PGP and >Pretty Good Privacy are registered trademarks of Pretty Good Privacy, Inc. >Permission is granted to the reader to reproduce and distribute exact >copies of this document, in physical or electronic form, on a >non-commercial basis (i.e., at no direct or indirect charge). This document >has been made available in hard copy on a subscription basis and is >available in public libraries in the United States. Accordingly, and solely >for purposes of U.S. Export Control laws and regulations (but not copyright >or other intellectual property laws), this document is considered in the >"public domain." The information in this document is of an exploratory or >experimental nature. As such, it is subject to change without notice and is >provided "AS IS." No guarantee is made that it is free of errors or that it >will meet your requirements. While we welcome your feedback on this >document, we are unable to provide any technical support for its contents. >...........................................................................

1 0

Bank for International Settlement (BIS) report on bitbux
by John Gilmore 17 Dec '03

17 Dec '03

From: Pete Yeatrakas <pyeatrakas(a)wespay.org> For those of you interested in security of electronic money, you may want to browse the Bank on International Settlement (BIS) page and read a report issued in 1996. BIS is the organization of G-10 central banks (e.g., in the US, Federal Reserve Bank Board) who meet to discuss international payments issues. The excerpt below is the first paragraph from http://www.bis.org/publ/cpss18.htm announcing the study of "security of electronic money," available in pdf format. BIS 1996 annual report (http://www.bis.org/publ/cpss19.htm) also provides detailed information about each country's payment system (currency in circulation, number of ATMs and financial institutions/branches, GDP, population - 1990 through 1995) and concludes with a comparative analysis of those countries (with currency compared in US dollars). This is a valuable resource for the student of European and US payment systems. (BIS home page is http://www.bis.org ) Best Regards, Peter Yeatrakas "Committee on Payment and Settlement Systems SECURITY OF ELECTRONIC MONEY FOREWORD In November 1995, the central bank Governors of the Group of Ten (G-10) countries commissioned a series of studies on specific issues related to electronic money, in view of the potential importance of this new form of money and its implications for monetary policy, consumer protection and payment systems. These studies were carried out by the Committee on Payment and Settlement Systems (CPSS). For the examination of the security aspects of electronic money schemes the CPSS sought the assistance of the Group of Computer Experts, which established for that purpose the Task Force on Security of Electronic Money, chaired by Mr. Israel Sendrovic from the Federal Reserve Bank of New York. At their meeting in July 1996 the G-10 Governors discussed the various reports that had been commissioned and agreed on the publication of the present report on Security of Electronic Money. The report is not necessarily intended to represent the official views of the Governors."

2 1

Opportunity
by Evil se7en 17 Dec '03

17 Dec '03

I need to find someone, preferably living in the Midwest, Great Lakes or Northeast part of the country, who knows the JAVA programming language. I am giving a two-day introductory course to the language next month in Cleveland. I will teach the first day, leaving someone to pick up the second day. You would be paid a fee plus all expenses. Please reply privately off list. se7en

1 1

WebWorld 23
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: PRESS REPORT - IMPORTANT?????
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > At 11:05 AM -0500 3/31/97, Ray Arachelian wrote: > >Is this for real or a troll??? > > > >On Mon, 31 Mar 1997, Anonymous wrote: > > > > >> >"Leading researcher Ari Lenstra last night announced major > >> >progress had been made towards a solution to the factoring > >> >problem, a result obtained by Sergei Ripov, researcher at > >> >an obscure university in the former Soviet union, shows > >> >conclusively that there exists a solution to the problem > >> >that is of polynomial time complexity, although this solution > >> >has yet to be found this signals the beginning of the end for > ... > > It sure does resemble my "Russian Factoring Breakthrough" post of several > years ago (April 1st, 1994, if I remember the year correctly). > > I had the same format: a reporter in Moscow, a press release, a secret > Russian research facility, and a breakthrough in factoring.... Actually, Timmy's was funnier. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Of interest, perhaps
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: ace(a)adelie.tidbits.com Mime-Version: 1.0 Date: Mon, 31 Mar 1997 16:42:16 -0800 To: Robert Hettinga <rah(a)shipwright.com> From: "Adam C. Engst" <ace(a)tidbits.com> Subject: Of interest, perhaps What do amber, beads, drums, eggs, feathers, leather, and oxen all have in common with the aforementioned shiny things? That's right! They've all been used at one time or another as money. (The oxen were hell on ATMs, but that's another story.) So, if you're feeling a little down in the wallet around tax time, circulate on over to the History of Money. The site, derived from a book of the same name, takes an in-depth look at where "wampum" has been and where it's going, from ancient times to the present day. Especially interesting is the chronology, giving the low down on loot from 9000 BC to 2002. That's well over a hundred years, according to our accountant. (Please note that not once did we say, "Show me the money!" See Jerry Maguire for more on this.) http://www.ex.ac.uk/~RDavies/arian/llyfr.html -- Adam C. Engst, TidBITS Editor -- ace(a)tidbits.com -- info(a)tidbits.com ----------------------------------- Answers to some common questions via email at faq-adam(a)tidbits.com or via the Web at <http://www.tidbits.com/adam/FAQ.html> Internet Starter Kit for Macintosh, 4th Edition now available <http://www.tidbits.com/iskm/> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Kent Crispin 17 Dec '03

17 Dec '03

On Mon, Mar 31, 1997 at 01:20:02PM -0500, Ray Arachelian wrote: > On Thu, 27 Mar 1997, Kent Crispin wrote: [...] > > > The only legal support needed for digital signatures > > > is for the courts to recognize that digital signatures > > > are equivalent to their analog counterparts. > > > > The *only* legal support? This is a *big* deal, and the issues are > > very complicated. Handwritten signatures and digital signatures are > > really quite different. > > I claimeth not lawyerhood, but IMHO, it can stand up in court if both > parties agree to it by analog signatures infront of a notray. I can comment, and I am not a lawyer -- I in fact know of one such case, where one large organization signed a MoU with another one that agreed that PGP signatures would be valid authorization for work orders and selected other transactions. This can be useful where the organizations in question have a long term relationship, and they are willing to go to the expense of drafting such a contract. > > > This could > > > be binding if the two parties sign something that says > > > "If I use PGP to sign a document I agree to allow that > > > document to be treated as if I signed it." (IMHO) > > > > Sure. It's been done, in fact. However, pairwise contracts with > > everyone you do business with is not going to cut it. You need laws > > for this. > > Not if it is agreed by all parties involved and their lawyers to honor > such signatures. (IMHO) Suppose I offer to sell you my car for $1000. We are not going to manually sign a contract to accept our pgp keys on a contract to sell the car, we will just do the total deal with manual signatures. Title will be transferred at the Department of Motor Vehicles with manual signatures. Smog certificates will be signed with manual signatures. It isn't worth the time and trouble to set up any kind of a special arrangement for digital signature for one time or sporadic, low volume transactions. Not until there is a legal infrastructure in place will we be able to do that. > > > [...] > > > > > > > 4) Businesses, especially large businesses, will (and do) > > > > want common standards for key and DS management. > > > Yeah, and they also want standards for software. [...] > > > > This is pair-wise contracting again. Note, incidentally, that > > standards concerning signatures are of a different order than > > standards concerning office software. There far more pressing > > liability issues with digital signature. > > Really? you must not have been gotten infected by the slew of Word and > Excel viruses out there. Might be a very good lawsuit against Micro$oft > that they allowed such things to happen. Not a chance. > Standards for a company are standards for a company. Which standard has > more weight or importance is up to that company. Sure, it is on a bigger > scale that installing XYZ OfficeWare and getting your ass fired, but it > is still a standard. We're not talking about standards for a company, we are talking about standards between companies, and government agencies. > Is there any reason that a specific company CAN'T decide to use PGP? (or > PEM, or some other scheme) if it so choses? All kinds of reasons. A Title Insurance company isn't going to be able to use digital signatures on Deeds of Trust without court approval, to just pick an example out of the air. [...] > > These are company signature > > keys, also used for encrypting email, so the company escrows all the > > secret halves of the keypairs. (There is no privacy issue here -- > > these are all company keys used for company business, all the > > encrypted documents are company documents.) > > So what's the problem? You hire people to keep track of assigning, > escrowing, and signing keys for your employees. You have IS staff and > security staff to watch for breeches. You can automate tons of this with > good written scripts that automatically scan all email for valid > signatures and raise alarms when signatures don't match. So what's the problem? Your answer is the problem: "You hire people...You have IS staff...You can automate etc" > Where is this not useful? For a small company a locked safe is plenty. > For a large company, you hire HR/Security folks to be your "Key Agents" > or whatever. This costs *money*. There is no reason to use digital signature unless it saves you *money*. A business isn't going to invest in DS infrastructure, especially of the scale you describe, just because they think it's fun. [...] > > > > Many commercial "standards" are legal standards, supplied by the > > government. In fact, the whole legal infrastructure of business law > > is really, when you get right down to it, a set of legally mandated > > standards. Standards are all over the map, when it comes to legal > > status. > > Because there are laws that force such standards on the company. This is a terribly simplistic view of things. Businesses also make good use of the level playing field that is provided by laws. -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

DCSB April Meeting Cancelled
by Robert Hettinga 17 Dec '03

17 Dec '03

No, it's not an April Fool's joke. (Or, maybe it is, but it's not mine, anyway.) It's 07:19. The commuter rail isn't running. The busses aren't running. The subways are only running where they're underground. Logan's closed and won't open until 3 this afternoon, which means that Stewart Baker can't get here to speak. And, finally, the Harvard Club, which is usually open at this hour for breakfast, isn't answering the phone, which makes sense, because the manager gave me his home number yesterday in case something like this happened, and I called him just now, and *he's* still home. :-). So, as they say in the movies, "Game over, man." I think it'll probably be easier just to cancel this month's meeting, and, if Mr. Baker wants to come some other time, we'll reschedule him -- and reschedule our other speakers, if necessary, to accomodate him. If folks really just want to delay the meeting and cobble together another program later this week or next, we can of course discuss it on the dcsb list. I'm sure the Club would love our revenue. :-). So, let's talk about the money, shall we? If you sent me a check for this meeting, and you plan on coming to the next meeting, I'll hold it for next time. Just let me know. If you sent me a check and you don't plan to come next time, I'd prefer to just tear up the check rather than send it back (I probably don't have the envelope anymore, anyway :-)). I'll send you a PGP signed confirmation of that fact, with the check number. However, if *really* want me to send your check back, let me know. Please remember to include your mailing address, so I know where to send it back to. Let me know if you have any other questions, and, see you next time! Cheers, Bob Hettinga (Snowed in) Moderator, The Digital Commerce Society of Boston ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0