December 2003 - cypherpunks-legacy

Re: Insecurity of public key crypto #1 (reply to Mandl)
by Eric Johnson 17 Dec '03

17 Dec '03

: From rarachel(a)prism.poly.edu Tue Mar 1 21:44:58 1994 : Subject: Re: Insecurity of public key crypto #1 (reply to Mandl) : To: ejohnson(a)pmip.dist.maricopa.edu (Eric Johnson) : Cc: cypherpunks(a)toad.com : X-Mailer: ELM [version 2.4 PL21] : Content-Type: text : Content-Length: 1207 : : > Would it not make sense, therefore, to publish a public cypherpunks : > mailing list key, which is returned with subscription requests? : > All incoming message cleartext to the mailing list server would : > then be encrypted in the server's key; not for security, but : > precisely for the reason you state above. That _would_ create : > quite a volume of encrypted communications to each recipient of : > the list. : : Please don't do that. I don't want to go through hoops to read this : mailing list. It's already cumbersome as is. Adding PGP in the soup : would make things very nasty. I'd rather not use PGP except for private : messages. That was exactly the point Eric Hughes was making; it is not a good strategy to save encryption for only private communications. Besides, procmail (or similar) should be able to handle piping incoming cypherpunks traffic through the decryptor, so the hoop would be transparent anyway. No muss, no fuss. --Eric

7 8

Re: Virtual Corporations to Avoid Taxes
by an64372＠anon.penet.fi 17 Dec '03

17 Dec '03

Timothy C. May writes: > Here's an area that has long fascinated me: using corporate entities > as a way to bypass taxes on individuals. > > [misc. examples deleted] I've been researching this and related topics (offshore corporations, non-U.S. banks, mail drops, etc.) and I have many ideas and questions I'd like to discuss. Is this an appropriate mailing list or does a superior venue exist? Is there enough interest for a new list? Are there any commercial providers that run electronic mailing lists (if so, how costly are they)? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

.
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

>What has not been discussed here very much and what I felt going into >the conversations with these people is that they *can't* tell us what >they are afraid of. It is not a matter of won't. The conversations >bore this out. We have been concentrating on in our discussion here >on how much they fear the loss of a power they have gotten used to and >abused to where we find it offensive. That is not nearly so much >what they fear. It is the *unknown*. It is pretty hard to make public >statements like that. Repeat after me: Change is our friend. We must embrace change. Change is good. We must lose our fear of change. Change...Change...Change...Change...Change...Change...(click)...Change...

1 0

Re: Dorothy Denning
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert Cain Writes: >What has not been discussed here very much and what I felt going into >the conversations with these people is that they *can't* tell us what >they are afraid of. Theodore Ts'o writes: >So if the cat really is out of the bag, then the government should give >up on this ill-conceived Clipper abortion as soon as possible. The fact >that the Clipper propoents may actually be recognizing the hopelessness >of their task this is a sign of hopefulness or a sign of great danger; >the question is whether they will act like rational human beings, or a >cornered animal. I think this is very perceptive. Clipper is perhaps the best they could _think_ of given an outmoded set of axioms. If the presumptions people in government have about their own role are no longer valid, they probably don't fully realize it yet, or at least can't admit they do. Clipper is just the kind of woefully clueless thing people in that position would come up with. It is kind of scary. Yikes. -- Will -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLXPOevfv4TpIg2PxAQE2zQP9HY7vmwAz73DDvW0wHti07p/4hlPOLouQ Yw0gj6Ixrxw00D1trdpZloU3pw5NfHrVGjcLvA12KMJqcjyh9Ga6+q1y/oQOoGzm q/8dTwgKT61pdkTKnPt8Esyy/g30Jzy+QODjdDFMkkey+KwE1vbKIJiQccPvZypJ rFpN4KOqBZ4= =Jo/p -----END PGP SIGNATURE-----

1 0

fyi
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

Sorry to inflict this *DRAFT* copy of a letter on the net, but I have begun to feel rather paranoid--the kind of feeling you get from stepping into deep water and being among sharks. (I wonder if Danny C. would have done better if he had kept the net informed as he went along?) I have been told that the court clerks and judge's secrataries (who work for the Justice Departement, and are not really under the control of the Judges) do abuse-of-process favors like thoes reported below for the US Attorneys all the time. When the name spellings and facts get checked, I plan to print it out, put on my suit, and hand deliver it to the Judge Patel in open court. I hope to report in a day or so. H. Keith Henson 799 Coffey Ct. San Jose, CA 95123 408-972-1132 Judge Marilyn Patel Northern District of California 450 Golden Gate Ave., 19th Floor San Francisco, CA 94102 March 1, 1994 Dear Judge Patel: As a friend of the court, I suggest you look into the actions of your clerks. It appears they withhold information from you and play games with your calendar. Last Thursday, Richard Williams (a lawyer from San Jose) made telephone contact with Ms Moriyama in the clerk's office. He had a motion to file for return of property and suppression of evidence in a case which itself involves a report of fraud on Judge Brazil to obtain a search warrant. Ms Moriyama told him that the motion could be placed on the calendar of your court for Monday, February 28, 1994 at 2:30 pm if he could get the motion filed early Friday morning. Mr. Williams had the motion filed by courier with the clerks office by about 9 am last Friday. He fully expected to be before your court Monday at 2:30. I learned of the hearing Friday and made plans to be there myself since my affidavit is part of this motion. Two of Mr. William's staffers talked to Ms Moriyama last Thursday, and are prepared to testify as to her agreement to putting the motion on your calendar, though the option was left open that you might shift it to some other department at the same hour. Monday about 10 am, Ms Moriyama called Mr. Williams saying she had no copy of the motion (two were filed) and denying that she had even agreed to put this matter on your calendar, or even that she had talked to Mr. Williams or his staff the previous week. She tried to get the matter placed before Judge Brenin, and when told that a Magistrate-Judge was unacceptable, she got the motion hearing placed on Judge Caulfield's calendar one day before the matter is to be moved to Tennessee, inflicting great costs and business damage upon the plaintiffs. While talking to Judge Caulfield's clerk on Monday, Mr. Williams was told that the US attorney had ordered the clerks to remove the motion from your calendar after it had been scheduled! Though I do not know that Judge Brazil ever saw the letter I wrote to him, one of his staff called me and left a long message (which I preserved) on my answering machine. In it, the staffer stated that it was not a Judge's role to investigate the fraud perpetrated on his court to which I had directed his attention, and that I should contact the US attorney if I wished the matter to be investigated. Given that the US attorney has manipulated your calendar to prevent these very matters from being brought to the attention of your court, I believe this approach would be akin to getting a fox to guard the henhouse. I have never considered myself a naive person. In spite of this, I have always felt that the judiciary in this country was honest. I still feel this way, but how effective can an honest judge be when their information channels are completely controlled by one party in a case? Sincerely, H. Keith Henson

1 0

No Subject
by nobody＠jarthur 17 Dec '03

17 Dec '03

Men in Dark Suits, sunglasses and trenchcoats FORCED Bob Cain to Say: > >it is well understood that only voluntary means of controling this >exist and that liklihood is very small. Persuasion is not working and >the press has been whipped into a near hysterical state over this by we >and our friends (yes, we on the internet are considered to be the force >that has derailed their hopes and that was unforseen.) Thanks Bob... that admission from the opposing forces has made all of our effort in this fight worth it... This makes the complete devaluation of this "Clipper/Tessara" nightmare relatively easy.... we doing good... keep the pressure up!! This has lifted the fog of battle for us momentarily... > >As is obvious I don't consider this government to be a monolithic >antagonistic entity out to strip us of rights. Sure it has happened in >areas but they are reasonably isolated areas. There are *many* people >in this rather diverse government and in an advising capacity to it >whose sole concern is our safety and these people are worried. I find My Saftey is REALLY NONE of THEIR concern... they have already insured in court they cant be held liable for mistakes... >it interesting that there are many people here who lack the imagination >to understand that there probably are a goodly number of reasons for >rightly feeling the need for a Clipper like solution and that it would >not be appropriate for the government to be public about them. Why is >that so difficult to understand in these times of international strife, >terror and technology? Here I start to wonder about you Bob... OUR Government caused the current issues we are seeing haunt this country... and they want the keys to ALL the secrest??? Not a chance in HELL Bob... I AND OTHERS WILL MAKE SURE THAT CLIPPER IS TOTALLY SUNK!!! count on it!! anon p.s. to the punks... keep it up... you are doing a GREAT job...(anon pats himself on the back also!!) > > >Peace, > >Bob >

1 0

Put Us To Work For You TODAY!!
by info＠we-work-for-you.com 17 Dec '03

17 Dec '03

*** To be removed from all of our future e-mails please reply with a subject of 'remove' or to be added to a national remove list please visit http://www.iemmc.org for name removal information. *** Visit http://www.we-work-for-you.com TODAY!! How many times has opportunity knocked and you have not been at home? Today, please take a moment to OPEN THIS DOOR! For many years, I have been convinced that there is a business opportunity out there that any and everyone could take advantage of, because of the sheer simplicity of the business. I have found such a business opportunity! What if you could have your own HOME BUSINESS and you could hire sales people to do all of the selling for you with NO PERSONAL SELLING OF ANY KIND? This business has NO OVERHEAD, NO EMPLOYEES, NO SELLING, NO INVENTORY, NO MEETINGS, NO HASSLES, and did I mention NO PERSONAL SELLING OF ANY KIND!! The best part of this business is that you are not paying the thousands of people who will be SELLING FOR YOU! If you choose you can just sit back and cash your checks. Is this free money? Not exactly, but it's as close as it gets. You are going to be making money from other people's marketing efforts. The fact that you are reading this e-mail is proof that we will be working for you! It will only take a few minutes to look further at this AMAZING OPPORTUNITY!! Someone HAS to make money from our marketing efforts. This could be you! Please visit our Internet web site at : http://www.we-work-for-you.com or Reply to this e-mail with 'info' as the subject and you will quickly receive an informative e-mail reply. There is NO OBLIGATION for looking at our web site or replying to our e-mail so take a few moments to look at this INCREDIBLE BUSINESS OPPORTUNITY! Sincerely, Razor Sharp Financial Services ~ Helping People Achieve Financial Freedom info(a)we-work-for-you.com

1 0

Re: Insecurity of public key crypto #1 (reply to Mandl)
by Eric Johnson 17 Dec '03

17 Dec '03

: > : Please don't do that. I don't want to go through hoops to read this : > : mailing list. It's already cumbersome as is. Adding PGP in the soup : > : would make things very nasty. I'd rather not use PGP except for private : > : messages. : > : > That was exactly the point Eric Hughes was making; it is not a good : > strategy to save encryption for only private communications. : > : > Besides, procmail (or similar) should be able to handle piping : > incoming cypherpunks traffic through the decryptor, so the hoop : > would be transparent anyway. No muss, no fuss. : : So, will procmail run for someone getting this mailing list via CCMail : under DOS? There are people doing that, you know. Yes, I am aware of that. : Its one thing to write tools so people can encrypt their routine : PRIVATE mail. Its another thing to encrypt mailing lists read by : hundreds of people. The former can be adjusted on a case by case basis : -- the latter cannot. : : Perry I don't think "adjust[ing] on a case by case basis" is necessary. I was suggesting just the opposite. It obviously isn't a security issue. I believe it is more of a first principles issue; "Thou shall encrypt thy communications, lest thou draw attention to thy self, and the right be removed by thine opponents." Oh well, since it was deleted in the first reply to my reply, let's try this again: Eric Hughes wrote: : If part of your communications are encrypted and part are not you have : sent the message about what information is sensitive and what is not. : This difference in encoding is a fir-class message in it's own right. : : Therefore _all_ communications should be encrypted at all time. It is : no argument against the principle that this is difficult to do at the : current time. Perhaps I am misunderstanding the above (I think not; "_all_" is fairly inclusive). I understand your argument about routine PRIVATE mail. However, key exchange alone involves considerably more hassle than what I am suggesting (and judging from the reply I got from Eric Hughes, I gather encrypting the list is hardly a new idea) which is this: there would be a tangible benefit from encrypting a list like cypherpunks with a well-known, even casual grade key. For God's sake, *especially* cypherpunks (you know, the name, power of example and all that) If the tools need to be built for some platform; well, "cypherpunks write code". Pipes _are_ available under DOS, you know. --Eric

3 2

Re: Standard for Stenography?
by tim werner 17 Dec '03

17 Dec '03

>Date: Wed, 02 Mar 94 22:32:39 PST >From: Jef Poskanzer <jef(a)ee.lbl.gov> > > In a physical meeting, the talkers would >notice the annoyed looks on the faces of everyone else; Don't forget the pleased looks on the faces of people who are glad to see that Jef P is working on stego. :-)

1 0

Re: Quantum mechanics banned
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

Tim May discusses ESP and quantum cryptography... > I learned all this watching "The X-Files." Well, *I* learned it by watching a crystal ball. -- Jay Freeman

1 0

Re: low-overhead encrypted telnet
by smb＠research.att.com 17 Dec '03

17 Dec '03

Eric Hughes says: > The reason that encrypted telnet is a good thing is that modificatio n > at the network level requires kernel modification, and encrypting a > telnet does not. Installing an encrypted telnet daemon does require > sysadmin cooperation, but it doesn't mean recompiling the kernel. Although running an encrypted IP stack does require sysadmin cooperation, it does not require a kernel rebuild -- John Ioannidis has built modloadable versions of most of the swIPe software. Assuming, of course, that you're running a system that has modload. (Ironically, CERT has recommended that you delete loadable device drivers from systems that don't need them, as a way to guard against password- sniffers.) > As such, encrypted telnet is a good intermediate while the long term > solution of encrypted IP gets developed and deployed. Agreed -- sadly its arriving VERY slowly. 4.4BSD Lite comes with a standards-compliant encrypted telnet implementation, however. What standards? There are no RFCs, nor any current drafts, that define a telnet encryption option. The last draft I saw was from 1991, and Internet drafts expire after 6 months. As I recall, the idea that was being pushed then was to integrate encryption more closely with authentication.

3 2

Re: low-overhead encrypted telnet
by Perry E. Metzger 17 Dec '03

17 Dec '03

smb(a)research.att.com says: > Agreed -- sadly its arriving VERY slowly. 4.4BSD Lite comes with a > standards-compliant encrypted telnet implementation, however. > > What standards? There are no RFCs, nor any current drafts, that define > a telnet encryption option. The last draft I saw was from 1991, and > Internet drafts expire after 6 months. As I recall, the idea that was > being pushed then was to integrate encryption more closely with > authentication. There are much more recent drafts, Steve -- the telnet authentication option is now RFC1409, as of early last year, and the encryption draft is dated April 1993 -- see the nearest internet drafts mirror for a copy. Your recollection of the desire to merge authentication and encryption is correct -- to my knowledge, the new Cray telnet is an implementation of the currently circulated draft (which was also written at Cray). Perry

1 0

RE: PGP on the HP 100
by Carl Ellison 17 Dec '03

17 Dec '03

>Has anyone tried putting ViaCrypt PGP on the HP-100? Is anyone but >me crazy enough to contemplate it? How abysmal is the performance? I may be crazier. I put it on a Mac (660) using SoftPC. It performs about like on a 286. However, that's plenty fast enough for my uses. - Carl

1 0

Re: Virtual Corporations Per Se
by Blanc Weber 17 Dec '03

17 Dec '03

> I've been researching this and related topics (offshore > corporations, non-U.S. banks, mail drops, etc.) and I have many ideas > and questions I'd like to discuss. Is this an appropriate mailing > list or does a superior venue exist? Is there enough interest for a >Don't think so. We better get a new list. .............................................. *I'm* interested ....... not simply to avoid taxes, but to live as a Hitchhiker Citizen of the Galaxy. :>) If a new list is started, you can add my name. ~ Blanc

1 0

Bob Cain's mind switch
by Carl Ellison 17 Dec '03

17 Dec '03

Bob wrote: >The real issue is that this is an *enabling* technology that allows any >group of people distributed over the world to meet spontaneously in >secret to plan anything. I don't think we can even conceive, nor have >they yet, the ways the real Bad Guys (I hope we can agree that some >do exist) might find to use this new ability. A very clear danger is >sensed in Washington with little real benefit to the civilized and >civil majority. There's no question that this is a possibility. It exists. However, Clipper won't make it go away. There's no Daddy to run home to. In fact, this has always been a possibility, unless you believe that all hotel rooms, bus stations, city parks, farmer's fields, men's rooms, women's rooms, ..., are bugged and will continue to be (so that clandestine meetings can be overheard). Now, the next step for the NSA and FBI is to get on the stick and discover ways to counter this threat. Now that PCs permit criminal organizations to create their own strong crypto and worldwide communication allows them to telecommute cheaply, interaction among criminals for planning purposes will be enhanced just as interaction among businesspeople and computer designers is. The world is changing -- as usual -- and LE needs to keep up -- as usual. --------- That isn't hopeless. However, it requires thinking in new ways and I don't expect bureaucrats to be able to do that. Perhaps technical people need to be given a free hand. :-| Maybe the result is that there is no security. For example, we should not expect to achieve more protection from plans laid during electronic meetings than we would achieve from plans laid during physical meetings. ..and, no, I don't believe there should be a law prohibiting private physical meetings. There will *always* be some insecurity. There is always a nut with a gun out there. There are also car accidents. I am not totally safe and would not want to live in a world in which the police are powerful enough to make it that safe. ---------- What I kept suggesting to Dorothy Denning, as this flap was building, was that: 1. the gov't should immediately drop the Clipper proposal because it's alienating people who need to be on the gov't's side; 2. the gov't should actively promote encryption of cellular calls with an untappable algorithm, for the over the air link (with conversion back to clear voice once it hits the cellular office) -- providing the public with trustworthy security, addressing the public's biggest security threat and therefore reducing the market demand for encryption which interferes with wiretaps; and 3. the LE and intelligence community should recognize that the world has changed beyond the point of no return, thanks to the PC and to communications technology, and there is no way to prevent criminals from using totally secure cryptography to aid in their plans. Criminals have always had access to strong cryptography for their communications (cf., Kahn talking about the rum runners, for example (Elizabeth Friedman's efforts as a cryptanalyst)) and the world hasn't fallen apart yet. However, the PC and high speed digital communications mark a slight change in the landscape and these changes need to fuel some good, creative, technical work -- not a bureaucratic running-scared retreat to an impotent "there oughtta be a law". I don't know if it's too late, thanks to the FBI and NSA serious alienation of people (like us) who matter. It might be. Once they declared war on us, it's unlikely to expect us to suddenly look at them as good guys. However, if they followed my 3 step plan right now, they'd have a chance still -- at least, I believe they would. - Carl

1 0

ALERT: UK anti-porn network proposal
by russw＠netcom.com 17 Dec '03

17 Dec '03

The author of the following notice is in a sensitive vocational position, and has asked me to post the following... ###BEGIN### A Home Office press release issued on 15 Feb 94 announces the intention of the Home Secretary to crack down on computer-distributed pornography. Accordingly, last week the government introduced an amendment to the Criminal Justice and Public Order Bill which is pending before Parliament. The new clause in the Bill would amend the definition of *publication* in the Obscene Publications Act 1959. It is currently considered *publication* of a pornograph image if one *record, shows, plays, or projects it.* The proposed amendment would change this to read: ... record, shows, plays, or projects it, or, where the matter is stored electronically, transmits that data. The problem, of course, is that there is no definition of what it means *to transmit* pornographic data. There is no distinction drawn between primary and secondary transmission. This could mean that bulletin board sysops, commercial sites with Usenet feeds, and even BT, could ALL be engaged in the *transmission* of pornographic data. If this is correct, then people in the position of innocent intermediary would have to rely upon a defense of *innocent dissemination*, much like that found in UK defamation law. Essentially, if the police could show that pornographic images had passed over one's computer equipment, then one would have to prove that he *had not examined the [pornographic] article and had no reasonable cause to suspect* that its publication was illegal. Aside from being in the uncomfortable position of having to prove one's ignorance, the *reasonable cause* language may imply a duty to inspect certain data in a vain attempt to see if it contains pornographic images. This especially could be true where one provides a data feed to a known past-pornographer. It is not entirely clear why the Home Office thinks that this amendment is necessary. If the intention is to catch commercial pornographers, it would appear that *record* should include recording to CD-ROM or into RAM. Likewise, *play* should catch purchasers. The justification might be that proof of recording and playing is much more difficult than proof of transmission. CAVEAT: This discussion does not include radio and television broadcasts. There is a seperate section of the Act which specifically addresses this area. It is not clear whether or not the proposed *transmits* language would have any effect upon that section, but presumably it could. It is difficult to believe that large players like BT, Mercury, CompuServe, etc, will let this pass without a fight. It could also be, however, that they are unaware of the possible ramifications of the proposed amendment. ###END### [I will forward responses to this message. - Russell] Russell Earl Whitaker russw(a)netcom.com Director, Extropy Institute 408-366-5435 ================================================================

1 0

Re: Clipper/Skipjack
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>just a quick note to tell you all that I just read an editorial in >info security by John Droge. >Anyway, I was wondering why any sane, 1/10 intelligent person would be >defending the Clipper chip...then I read his bio...he is a VP at >Mykotronx. He is also the marketing manager for CLIPPER/CAPSTONE

1 0

'Nother possible Stego place...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

It's a bit of a hack, but don't most char implementations in C just ignore the high-order bit? --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 na53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1

Re: encrypting the list (Was Re: Insecurity of public key)
by Eric Johnson 17 Dec '03

17 Dec '03

: Eric Johnson says: : > I don't think "adjust[ing] on a case by case basis" is necessary. : > I was suggesting just the opposite. It obviously isn't a security : > issue. I believe it is more of a first principles issue; "Thou : > shall encrypt thy communications, lest thou draw attention to thy : > self, and the right be removed by thine opponents." : : You miss the point, Eric. We are advocating that IN THE FUTURE all : communications should be encrypted. However, FOR THE MOMENT this is : often impractical. Cypherpunks write code in an effort to try to bring : this future closer. However, making our lives impossible right now : will delay that future. This is hyperbole. It would not make our lives impossible. And far from delaying the future, as it relates to communications on the list, I would argue that it would reduce the signal-to-noise ratio immensely, thereby hastening the deployment of tools. So I don't think I'm missing the point simply by disagreeing with you. : I encrypt things whenever possible. Some people I communicate with : can't encrypt, so I adjust, on a case by case basis. Someday, : hopefully within the next year or two, things will be different. : : Encrypting this list ever would be useless -- but fine if it would : be easy to do. Since it isn't easy or useful, it is a bad idea. It's usefulness depends both upon whether you think increasing the ratio of cryptext vs. cleartext to your system is useful, and whether easy is defined by the least capable systems on the list. Don't worry. I'll drop it here. : : Perry BTW, you don't have to shout. I can read upper-lower case text without difficulty. --Eric

2 1

Defenders of Clipper
by area51＠aol.com 17 Dec '03

17 Dec '03

Hi everyone, I've been watching this list for a few weeks now, and I really don't see any real basis for defending Clipper. It seems the essential arugment of Denning and others is, "Well, we can't tell you what we're afraid of, but trust us, we should be afraid". Can they not tell us because they don't know? Or is it some sort of "secret" they fear? Obviously, widespread secure communications would make life much easier for criminals. Yes, terrorists will be able to make their secret plans using cryptography. But, I would hasten to point out that the Trade Center bombers managed to pull their attack off with NO encrypted conversations that I've heard about. And yes, next time it might be a nuclear bomb. There, is that the unnamed terror? Or is it that the intelligence community is learning all the neat-o toys they bought for SIGINT are rapidly becoming worthless, and in reality there's absolutely nothing they can do about it. They'll have to strengthen their long neglected human intel-gathering side, much as some members of their own community have been arguing for years. The real reason Denning, the NSA, et al are arguing for Clipper is that they realize their professions are becoming obsolete. Welcome to the ranks of the techo-unemployed. Just as nuclear proliferation marches on slowly but surely, so will high-tech crypto. Information wants to be free, as they say, and the implication here is you just can't stop it. Does the government really think they can stop everyone in the world who wishes this nation harm from using crypto? I think not....So they better get on the ball really defending us... Sorry for rambling on.... Rod Ramsey Area51(a)aol.com

1 0

PEM, was Re: low-overhead encrypted telnet
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 2 Mar 1994 11:55:32 -0600 (CST), Jim McCoy <mccoy(a)ccwf.cc.utexas.edu> writes: > I sincerely doubt that such a system would be designed or implemented > before the turn of the century. All one needs to do is take a look at the > PEM key certification authority clusterfuck to see just how difficult it > can be to implment something like this. I have to admit that PEM's RSN availability against PGP 2.X's 20+ months of worldwide availability has made me not keep up with PEM and the latest hierarchical, government controlled certification process... But is there an intrinsic problem with a PGP-style web of trust for remote telnet/rlogin applications. I really don't expect to login to arbitrary nodes on the net, but is that required? or simply a robust way (SecureID in software?) Maybe PCMCIA cards with PGP once desktop systems have them. If i'm cluelessly missing something essential, please email me the news. Thanks Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via firger #include <standard.disclaimer>

1 0

RE: Laziness?
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 2 Mar 1994 10:38:55 -0800 (PST), tcmay(a)netcom.com (Timothy C. May) writes: > I connect to the Net from my home Mac IIci or PowerBook 170 over a > 14.4 modem line to Netcom, an Internet service provider many of you > are familiar with. Once on Netcome, I have access to a wide range of > standard UNIX tools. However, I do NOT run PGP on these machines! > > Rather, I run MacPGP (or PGP on my DOS machines, in emergencies, or > even "MailSafe" in rare circumstances) on my *home* machine, after first > downloading the mail with "Eudora 2.0," a nice off-line mail reader. > It still takes several steps, as most of you can imagine. I use a similar system to Tim's, except that I use NUpop on a "PC" to download 150+ messages a day from cypherpunks and a bunch of other lists. We have to move the tools to the user's controlled, secure environment. For some that may be Unix, but for close to 98% of the 'net community, a controlled computer is a Mac or PC. At GMU, a few supported grad students have personal Suns or other workstations, maybe 50 students out of 22,000. But nearly all of the students in the techy schools have at least a PC or mac that is under their personal control. Multi-user Unix solutions don't cut it. More importantly, if all 700+ of us on this list used encrpytion for _every message every day_ it would be only an insignificant portion of the net volume. We have to get encryption out to the masses. Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Windows Programming help wanted.
by Pat Farrell 17 Dec '03

17 Dec '03

This is a repeat of a request that I made last fall. I got no real response then. Perhaps as the list has grown, someone will respond.... I am looking for help on a Microsoft Windows development project. I have most of a Windows Client SMTP mail client program written, but I can't devine how to make the Windows Communications API work with any marginal success. I need help from someone who has written Windows communications software. The program is functionally equivalent to NUpop or Eudora. It is designed to work over dialup asynchronous lines without TCP/IP. Not that I dislike all the nice functionality tht TCP/IP provides, but because some netowrk providers (such as George Mason University) refuse to support SLIP/PPP for political reasons, and because other providers (Netcom for one) charge orders of magnitude more for SLIP/PPP than for async support. The resulting product will be user firendly, a native Windows program with the usual buttons, icons, context sensitive help, etc. It will have PGP, and maybe RIPEM, support built in. Automagically. I plan to release the code to the net, and will give full credit in the About Box, documentation, etc. for any help. Please respond via email. Cypherpunks write code. Thanks Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: Insecurity of public key crypto #1 (reply to Mandl)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

A while back, when people were starting to talk about encrypting the list, someone like Eric Hughes pointed out that, if you *want* to run an encrypted, or batch-digested, or whatever, version of cypherpunks, you were free to do so - just set up your system and have it forward cypherpunks to your subscribers. Somebody could still do it now (not me! :-), preferably outside the US where the problems of RSA/PKP patents don't apply. The flip side of the problem is building an automagic decryptor for mail sent *to* cypherpunks, though you could accomplish part of that by using the extropia anonymous remailer which accepts encrypted mail. On the other hand, doing either of these functions on toad.com today risks subjecting John and friends to harassment from RSA (unless toad.com happens to be a Sun 486i or really hot box with SoftPC that can emulate Intel code fast enough to run ViaCrypt.) Bill

1 0

re: Denning
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I agree with those who oppose unwarranted attacks on Dr Dennings character. She is by all accounts an intelligent, well-mannered person and deserves to be treated as such. I completely disagree with her about clipper however. I have watched with growing horror as our government over the last 15 years has slowly turned into a near fascist state. Black clad commandos storming a religious group's compound deliberately inciting an armed confrontation, then harrassing for more then a month, then initiating an attack that left most members including the children dead. People who had not been convicted of anything. We are told if we only knew, we would support clipper, I think not. Hide behind your secret information if you chose, we have a general idea of what you fear anyway. We are less worried about nuclear/chemical/biological/informational terrorists then we are of what our government could become with such fascist tools. After all, there are terrorist acts now, when you can listen. Its about privacy...... Its about adults making their own decisions, not some paternalistic government, no matter how well meaning, doing it for us. We will build the tools we need, we will bypass attempts to stop us, we will advance till our communication ressembles noise. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXUQbdCcBnAsu2t1AQG9OgQApYhHWjg47wShhzMfQL2LedmAv5j52Ijb H7V+0EO3V4VFsJ2qgtEvOZNHDs2XBCcIthxbpfALOn+V+PY/0eayff5gHBfirKpX AyXRSdGabqA7uVu0PgSSH31fG4OLL4j91crI/9HrVccztfOMGv2dcZGdpyNLBGRi OEW8ZBGieCg= =I02i -----END PGP SIGNATURE-----

1 0