December 2003 - cypherpunks-legacy

LD
by frc%bwnmr4＠harvard.harvard.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Len, Do you want to me start taking you seriously again? (I used to. You posted some great stuff.) Try signing your posts. Prove your identity. Then maybe I'll start believing that the same guy who wrote the anonymity faq is losing his marbles over spoofs. FRC -- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLM2ikbbAlE4AqlTZAQFV5gP+IZE8VupNW6iJxinLlQreJAV8HWXwXyAz sUOsqLUAcN6T75iFjM+X8fprUVhQFci5Nq1IfpPLWZpOmL9TVdoBmtlSX3EFOpdB nX7aaq3FN2b0v5Rd5PAJlvY3fbSDDWRdEx6n4zI6l7Adc8+8iHeJqdpHUSjy8uak TjNJpZSNYHQ= =npG/ -----END PGP SIGNATURE-----

1 0

DC-nets, up from the basic concept
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

A few pseudonymous questions went astray and landed in my mail box among a few others (without much of a return address too... the problems of anonymity) So I'll volunteer some possible answers, and while doing so will generate more questions :-). Others feel free to elaborate (especially thoses who HAVE read the papers) Still, no mention of detweil(er)ing will be made :-) although I will mention spoofing... 1) "PHYSICAL LAYER" =================== Q: How do you implement the idea that I can see my coin and the coin on the left, but no others? A: You use public key cryptography. You join a "table" by contacting one of the persons already at the "table". He hands you address and public key of (say) his right neighbor, and you hand him your address and your public key. Each time you "toss a coin" you encrypt it and send it to his ex right neighbor (now your right neighbor). You use the same public key protocols to send out to everybody your "different/same" vote, and collect and count everybody elses. It's easy to add and remove individuals, and you can be part of as many "tables" as you want. 2) MORE SPOOFING ================ New question: how do you make sure you are not spoofed to death, and (mis)led to join a "table" of, say, 126 personae of the same three letter entity, and Yourself. In which case, your messages are not very untraceable anymore? Not very satisfying answer: you meet in person your left AND right neighbor at least once to exchange address and keys... Any better answer? 3) GROUP RESPONSIBILITY AND HIGHER LAYERS ========================================= Q: couldn't every member of the group be implicated because they must all participate to produce the bit of information? A: No, when a "table" is established, what you have is a CSMA/CD network in the classical sense (CSMA/CD = Carrier Sense Multiple Access/ Collision Detection) just like Ethernet is one. Your "DC-net physical layer" is now very complicated, and multi-layered itself, but that only affects speed, not much else. You could (maaaybe :-( establish the layering: Coaxial - Ethernet - IP - TCP / Telnet - RFC822 email - PEM - DC-net - IP - TCP / Telnet - RFC822 email - PEM Except that now, your second layer of TCP/IP is untraceable. By the same token (sorry :-), once you have these protocols established for one "table", you can internetwork many "tables" at will. Poof! Inter-DC-net! But, boy, would the above implementations be slow :-) In any case, even though the participants of any network must cooperate for any message to go through (especially true in the case of Usenet, or FIDO, for example), it is hard to hold all the participants responsible for every message just for being part of the infrastructure. It would be different (even with todays networks), if a large proportion of the messages were CLEARLY illegal. Still, even now, it is impossible to tell whether an encrypted message's content is illegal or not (see the previous netnews discussion with respect to FIDO, mail privacy and encryption), and peeking in un-encrypted email is illegal, depending on caller contract. So I would, until contradicted by the legal types among us, consider a DC-net or Inter-DC-net no different legally, than any other cooperative network out there (Usenet, FIDO, internet...), until specifically regulated. Disclaimer: Of course, this is only a technical opinion, legal decisions may or may not consider the technical precedents :-) Reasonable technical arguments have as much weight legally as unreasonable ones (or so it seems at times) (meaning: of course, I'm not a lawuer) Pierre. pierre(a)shell.portal.com

2 1

h
by fnerd＠smds.com 17 Dec '03

17 Dec '03

------BEGIN PGP SIGNED MASSAGE------ Cpunx-- Sorry for the premature post on signatures in Mush. I looked at the sources to figure out how to use it. If you want to append a multiline signature to your messages without adding the gratuitous "\n--\n", do something like this in your .mushrc: set autosign='\-fnerd\n\ quote me' I'll pass on any other relevant tidbits I receive by email. And thanks to Eric Hughes for getting me off my butt for a bit. -fnerd quote me -----BEGIN PGP SIGNATURE----- Version: 2.3a +aKxB8nktcBAQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvtoxiQCVAgUBLMs3K ui6XaCZmKH68fOWY ySKAzPkXyfYKnOlzsIjp2toust1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hanC0R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: Enough!
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

"Philippe_D_Nave" writes... > Newbies : If you think that there is stature to be gained by > joining in this sorry spectacle, think again. The only > place you can gain respect by abusing someone else is a > street gang (or the U.S. Congress, perhaps). > Pretty presumptuous of you to attach a motive to my post. I don't think my post was abusive, and I didn't post it in an attempt to "gain stature". Jim_Miller(a)suite.com

2 1

How do I unsub
by Matt Harrop 17 Dec '03

17 Dec '03

Could some kind person tell me how to get myself off this list. The signal-to-noise ratio has become far to high.

1 0

sure...
by Alexander Reynolds 17 Dec '03

17 Dec '03

..I'll do my best to provide you with some literature on behavior control. I've got midterms this and next week, so a more complete bibliography will have to wait for a few. One book which I can say is a good intro to the topic is B. F. Skinner's _Beyond Freedom and Dignity_. It isn't as scientifically rigorous as most psych texts I've seen, but it's a good start if you want to really pursue the topic. Hannah Arendt's _Totalitarianism_ looks a bit into the nature of behavior control from a poli sci view. There are more, and I'll create a list ASAP. Later, Alex

1 0

CyberDesk
by DON_HENSON＠delphi.com 17 Dec '03

17 Dec '03

A recent article in CompuServe Magazine concerning encryption made passing mention of a Nan Atwell of CyberCorp and a product called 'CyberDesk' which gives users a single windows interface to multiple e- mail and public information systems and has a seamless hook to third- party encryption programs of the users choice. Unfortunately, the article failed to include any contact info. Does anyone know how I can contact Nan Atwell or CyberCorp? An email address would be ideal but a vox phone number, a USnail address, or even a (Yuck!) fax number would be sincerely appreciated. Please respond via private email (Don_Henson(a)delphi.com) if you can help me. Don Henson PGP key avail on server or on request

1 0

CONFERENCE: The Security Services: Are They a Threat to Freedom?
by 1＠eternity.demon.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Libertarian Alliance One Day Conference THE SECURITY SERVICES: ARE THEY A THREAT TO FREEDOM? Date: Sunday, 14 November, 1993 (PLEASE NOTE THAT THIS CONFERENCE IS ON A SUNDAY, AND NOT A SATURDAY AS IS OUR NORMAL PRACTICE) Admission: 5.00 pounds UK per person. By ticket only. Venue: The Jubilee Room The New Cavendish Club 44 Great Cumberland Place (entrance in Upper Berkeley Street) London W1H 8BS (Nearest tube: Marble Arch) 10.30am - 11.00am Arrival - Tea and Coffee will be served Introduction by Simon McIlwaine, Conference Chairman 11.00am - 12.00pm Brian Crozier "The Security Services and Their Role in A Free Society" 12.00 Noon - 12.30pm Discussion Brian Crozier is one of Britain's leading thinkers and writers on foreign policy and defence issues. His books include Strategy of Survival, The Rebels, A Theory of Conflict, Neo- Colonialism, The Future of Communist Power, The Minimal State and The Struggle for the Third World. His autobiography, Free Agent, was published this year and extracts were serialised in The Times. 12.30pm - 1.30 pm Lunch Break 1.30pm - 2.30pm Robin Ramsay "Unsupervised and Uncontrolled: The Problem of Security Services in a Free Society" 2.30pm - 3.00pm Discussion Robin Ramsay is editor of Lobster, Britain's premier, and highly respected journal on parapolitics, "conspiracy" and the "secret state". He is co-author of Smear: Wilson and the Secret State and has contributed to a wide range of publications, including Tribune, Open Eye, and The Times Higher Education Supplement. 3.00pm - 3.15pm Tea Break 3.15pm - 4.15pm Larry O'Hara "Searchlight Magazine: A Case Study in Secret State Media Manipulation" 4.15pm - 4.45pm Discussion Larry O'Hara is an independent researcher into fascism and the "secret state". He is currently completing his Ph.d on "The National Front, 1986-1990" at Birckbeck College. His articles include "Notes From the Underground: British Fascism 1974-1992" in Lobster and "British Fascism: The Persistence of Anti-Semitism" in Return. 4.45pm - 5.45pm Brian Micklethwait "What Should Libertarians Do About the Spies?" 5.45pm - 6.15pm Discussion Brian Micklethwait is Editorial Director of the Libertarian Alliance. He appears regularly on British television and radio on behalf of the LA as well as speaking widely at universities and political meetings. As well as his writing for the LA, he has contributed to such publications as Economic Affairs, Gay News and Ideer Om Frihet. 6.15pm Close of Conference - --------------------------------------------------------------------- Please send me ... ticket(s) for the LA Conference "The Security Services: Are They a Threat to Freedom?" on Sunday, 14 November, at 5.00 pounds UK each. I enclose a cheque/postal order/cash payable to the Libertarian Alliance, for ...... Name: .................................................... Address: ................................................. ................................................. ............................. Tel: .............. (Useful if we have to notify you of any last minute changes) _____________________________________________________________________ Please Return by First Class Mail to: Chris R. Tame Director Libertarian Alliance 25 Chapter Chambers Esterbrooke Street London SW1P 4NN -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLM0FDoTj7/vxxWtPAQGhQwQAuhIjIa11jqmRwIpb9JHQqwjaCa/3IhWH b34HfewITnM1q/lzTCdFk/YU/6cAGC+0rdinLjJcb1wadXo5wx+dyeScFr7yaEaN fAgD349hA03Xng8Wt0NLJVawPd9nguIeoslwMf6Z2m/iYa89xpfaRU/AvhUZg4lP 6A2DyUOXaI4= =F5u2 -----END PGP SIGNATURE----- Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor AMiX: RWhitaker EXTROPY: The Journal of Transhumanist Thought Board member, Extropy Institute (ExI) Co-organizer, 1st European Conference on Computers, Freedom and Privacy, London, 20 November 1993

1 0

CONFERENCE: European Computers, Freedom & Privacy (ECFP)
by 1＠eternity.demon.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ECFP '93: The First European Conference on Computers, Freedom and Privacy The New Cavendish Club London, England 20th November 1993 Organised by ECFP Ventures Limited Co-operating organisations : The Libertarian Alliance Privacy International, UK UK Cryptoprivacy Association SCOPE - ---------------------------------- The widespread use of computers and communication systems has brought considerable benefits to our business and personal lives and will continue to change and shape the way in which we live. However, with those benefits come unprecedented threats to our personal privacy and potential for abuse. A variety of different models for protection of individual privacy in the electronic age have been suggested, ranging from state regulation to individual action through the use of strong cryptography. However, these solutions bring with them their own class of problems, including excessive state involvement in private matters and the frustration of law enforcement and national security objectives. The First European Conference on Computers, Freedom and Privacy will both provide an introduction to these issues and the technological developments that drive them, and examine different ways in which individual rights can be guaranteed. These questions are central to the preservation of a free society in the Information Age. John M. Brimacombe Conference Chair KEYNOTE SPEAKER - ---------------------------------- John Gilmore Email: gnu(a)cygnus.com JOHN GILMORE is Chairman of the Board of Cygnus Support, who provide commercial support for free software. As founder and board member of the Electronic Frontier Foundation and the Cypherpunks, he has campaigned extensively for electronic privacy. John will speak on building a society in which personal privacy is guaranteed through the use of strong cryptography. OTHER SPEAKERS - ---------------------------------- John Brimacombe (Chairman) Email: john(a)mantis.co.uk JOHN BRIMACOMBE is the Managing Director of Jobstream Group plc, developers of business software. A graduate in both law and computer science, he was an advisor to CFP '93 in San Francisco. John will serve as conference moderator. Simon Davies Email: davies(a)privint.demon.co.uk SIMON DAVIES is Director General of Privacy International and a member of the School of Law at the University of New South Wales. He will be looking at new developments in surveillance and ways of combating them. Tom Burroughes Email: tom(a)reptile.demon.co.uk (after 10 October 1993) TOM BURROUGHES is Deputy Chief Reporter with the East Anglian Daily Times in Ipswich, England. He will be giving a journalist's point of view on privacy issues, including recent incidents involving eavesdropping on cellular telephones, and the roles of various corporate and government bodies in the recent adoption of cellphone signal encryption standards in the UK. David Chaum Email: chaum(a)digicash.nl DAVID CHAUM is head of the Cryptography Group at the Center for Mathematics and Computer Science (CWI) in Amsterdam, and founder of DigiCash, which develops electronic payments systems. Dr. Chaum received his Ph.D. in computer science from the University of California, Berkeley, in 1982, and joined CWI in 1984. He helped to found the International Association for Cryptologic Research and remains active on its board. David also consults internationally on cryptology. Duncan Frissell Email: frissell(a)panix.com DUNCAN FRISSELL is an attorney, technical author and consultant on matters of personal and financial privacy. Duncan will speak on "Traditional Privacy in the Electronic Age". Elaine Fletcher ELAINE FLETCHER is Assistant Solicitor for Eric James Howe, Data Protection Registrar (UK). Elaine will speak on issues arising from the Data Protection regime established under the 1984 Data Protection Act. Chris Tame CHRIS TAME is the Director of the Libertarian Alliance and Director of the smokers rights group FOREST, as well as UK representative of the Libertarian International. He has written extensively for such academic journals as /Science and Public Policy/, /Economic Affairs/, and /The Jewish Journal of Sociology/, and such books as *The Case For Private Enterprise* and *The Politics of Crime Control*. He appears regularly on radio and television in the UK. Chris will speak on the libertarian views of data protection and privacy. Russell Whitaker Email: whitaker(a)eternity.demon.co.uk RUSSELL WHITAKER, conference co-organiser, is a consultant on electronic communications, a director of ECFP Ventures Ltd and communications editor of Extropy magazine. Russell will speak on the composition of, and influences upon, the electronic community in Britain today, and how public policy affects those on computer bulletin boards and online services. PROGRAMME - --------------------------------- Registration 9.30 - 10.00 am First session 10.00 - 11.30 am BREAK 11.30 - 11.50 am Second session 11.50 am - 1.20 pm BREAK 1.20 - 2.20 pm Third session 2.20 - 3.50 pm BREAK 3.50 - 4.10 pm Fourth session 4.10 - 5.40 pm PANEL SESSION 5.40 - 6.20 pm Closing remarks 6.20 - 6.30 pm Lunchtime is the break after the second session, and lunch itself is not included in the price of the conference. There are pubs and restaurants in the immediate vicinity. Coffee, tea and biscuits will be on sale through the day, however. Registration form: - --------------------------------- NAME _____________________________________ JOB TITLE _____________________________________ ORGANISATION/AFFILIATION _________________________ ___________________________________________ MAILING ADDRESS _____________________________________ ____________________________________________________ ____________________________________________________ ____________________________________________________ TELEPHONE ___________________________________________ FAX ___________________________________________ E-MAIL ___________________________________________ IMPORTANT NOTE: only *fully* completed forms with full telephonic details will be accepted, to be used in the event of any emergency changes, such as change of venue. This is not optional. CLASS OF REGISTRATION : [Prices are Pounds Sterling] Student 10.00 ($16.00 U.S.) Normal 17.50 ($28.00 U.S.) Normal before 1 Nov 93: 15.00 ($24.00 U.S.) Press (Contact for arrangements) MEANS OF PAYMENT: - U.S. cheques/cash - U.K. cheques/cash - EuroCheques (tm) Unfortunately, due to bank conversion charges, we are unable to accept cheques drawn on other overseas accounts, for payment of this year's attendance fees. PROCEEDINGS AND AUDIO/VIDEOGRAPHY - ------------------------------------------- You may pre-order copies of transcripts of the proceedings, which will be shipped within 90 days after the conference: "Please send me ____ copies of the conference proceedings at 20 pounds each." Video and audio recordings will be made of the conference, in its entirety. No pre-sales will be made; tapes go on sale in December 93/January 94. Cheques, made payable to "ECFP Ventures Limited", should be sent with this form to : 16 Circus Road MM Box 8593 London NW8 6PG England Please direct any further enquiries to the above address, or: ecfp-1st(a)eternity.demon.co.uk (Email) +44 81-812-2661 (Manned message service; quick response) HOW TO FIND THE NEW CAVENDISH CLUB : - ---------------------------------------------- The New Cavendish Club is 2 minutes walk from Marble Arch Underground station. Immediately turn right as you exit from the station onto Oxford Street. Then take the first turning on the right, i.e. Great Cumberland Street. The New Cavendish Club is 3 blocks north on the northeast corner of the intersection of Great Cumberland Street with Upper Berkeley Street. Address: New Cavendish Club 44 Great Cumberland Place London W1H 8BS - ----- Text ends --------- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLKjhjYTj7/vxxWtPAQGjQAP+NW1LOc806i0c3MmA2RiluzWmDKvFEPPm ibtU3tbqqF93fb0lqJ/z1q8DEtWeiG6LnLQ41IasIHDL6o7EmZEWXN6G17CDFLSk cQHCGaIpC9BkBI8VwnsPZIlItL5T+TkcOwLjdqp7x24tQ9uAm3BhpFLGMfLJAnwB xI/ZG0zMEIs= =QElR -----END PGP SIGNATURE----- Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor AMiX: RWhitaker EXTROPY: The Journal of Transhumanist Thought Board member, Extropy Institute (ExI) Co-organizer, 1st European Conference on Computers, Freedom and Privacy, London, 20 November 1993

1 0

CPSR Crypto Resolution
by Dave Banisar 17 Dec '03

17 Dec '03

CPSR Crypto Resolution CPSR Cryptography Resolution Adopted by the CPSR Board of Directors, San Francisco, CA October 18, 1993 WHEREAS, Digital communications technology is becoming an increasingly significant component of our lives, affecting our educational, financial, political and social interaction; and The National Information Infrastructure requires high assurances of privacy to be useful; and Encryption technology provides the most effective technical means of ensuring the privacy and security of digital communications; and Restrictions on cryptography are likely to impose significant costs on scientific freedom, government accountability, and economic development; and The right of individuals to freely use encryption technology is consistent with the principles embodied in the Constitution of the United States; and The privacy and security of digital communications is essential to the preservation of a democratic society in our information age; and CPSR has played a leading role in many efforts to promote privacy protection for new communications technologies: BE IT RESOLVED THAT Computer Professionals for Social Responsibility supports the right of all individuals to design, distribute, obtain and use encryption technology and opposes any government attempt to interfere with the exercise of that right; and CPSR opposes the development of classified technical standards for the National Information Infrastructure.

1 0

blacknet international offers DOSSIERS for SALE
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

blacknet international is pleased to offer the following materials for sale: DOSSIERS: on the current participants in the Cypherpunks Mailing List Flame war PRICES: Prices and delivery terms upon request via encrypted anonymous return address. SUBJECTS: Perry Metzger <pmetzger(a)lehman.com> Duncan Frissell <frissell(a)panix.com> S. Boxx <an12070(a)anon.penet.fi> L. Detweiler<ld231782(a)longs.lance.colostate.edu> Timothy C. May <tcmay(a)netcom.com> Ray Cromwell <rjc(a)gnu.ai.mit.edu> David Sternlight <strnlght(a)netcom.com> These are available now via PGP encrypted return anonymous mail. To reply to I/We please use the enclosed public key to encrypt your message back to us. The anonymous remailer encrypted return block may be used for now but if current(known to be good) paths are needed look for the latest in cypherpunks(a)toad.com. Please encrypt ALL mail sent to us... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAizMFlcAAAEEALPYHDpT3OhTyO0qfEcqnbwY30pZb3ET6JUP70jfIQPiTrkA i7WJFYnDWv0FBk3aMxfH2DpI0fauCQKLnJJrc0/WHi5AgZVJh7KTwfCyAS+Zr2xM 7xjFZlwd9Q0Ow5k3hLfO4LQpTOW8IBMATV8or1g/+Zv3m87WjLgMmjAEwDypAAUR tDxibGluZHBpcGUgPHVzZSBjdXJyZW50IHJlbWFpbGVyIGJsb2NrIHBvc3RlZCB0 byBjeXBoZXJwdW5rcz4= =IHVG -----END PGP PUBLIC KEY BLOCK----- --------8<--cut here-->8-------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.3a hEwClqx1g6tk6KcBAf9Nly0MsbjTHys9iZwvkew2KEls/4T+4uXG+Ri8gtJnA9P0 5NvGZYIU0A40CHeHWttwE+cjwVyREWWcCPUVeMqcpgAAAYWHYP4OYPHDdUFKrs1i FW2F5lMQ1m4pU475xcLJH+NqQUYToSqmTlyH5dlOLmkC0s97n2OMQKJyDkUHkIbZ nqEg42KQkjAWotu85dBuXFjgLyShkACvah/VBXYcKHMsgfO41tCbCQiWVkg022/F TheZmlX5mPj0pgLFlpd+nYYIsGcH2memKLXWuhaY4yThRPYCu5OEYBlQEE1TtQTs glC6926Nu1RHvs4ivD3OabzeLdl2Kh2wZI2IcznUKOIKhH3nsXgI9ZvuHVkrKkmw 5ABXnhj2rgWW6/SxOT6XejUKH6WHu82HBjnEi6dDviB5pnGL8D2ayxw+ySwjNZ94 lJyrGVeq40XVG4HywxUbmrSbM/a6OOvH2f5zmXQAccoj2iwWa0khPJ0kjlndV/I9 FSLeIP8BZZSHU1tA9/genoDd3auQDAregfuzA10KjVr96+TcLdlh/7eM9TfQDaPz VtCrLR+X/n2J083WtmyzbZhpeI2qzjL7YqPXNlRsofenVucl3E1k0A== =WPI/ -----END PGP MESSAGE----- <To reply, save everything below the "cut here" marks above <into another file. Type your reply here (below the blank <line three lines above!) and mail to remailer(a)utter.dis.org ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 3

Re: anti-social behavior
by Duncan Frissell 17 Dec '03

17 Dec '03

B >ASAR stands for "alt.sexual.abuse.recovery", a newsgroup I run an B >anonymous server for. This group actually has survivors of all B >sorts of abuse, including the verbal abuse that rjc perpetrated. "Sticks and stones" etc. --- WinQwk 2.0b#1165

3 2

: a desperate please
by Duncan Frissell 17 Dec '03

17 Dec '03

A >I can't come up with any good ones, except for "fun" and "just to see A >what it feels like to put out opinions not my own." Virago is a "feminist" publisher in the UK. A few years ago, they brought out (to wide critical praise) a collection of short stories about immigrant life in the UK by a new Asian (means from the Indian subcontinent in the UK) woman. They had never met her and were very embarrassed when "she" turned out to be a retired, male vicar. Seems like a good idea to use a pseudonym in this case. I guess that is the use you meant about "putting out opinions not my own." Whenever I want to do that I just switch to lawyer mode. Duncan Frissell --- WinQwk 2.0b#1165

1 0

ADMIN: toad.com's mail hicups Tuesday morning...
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

The list mailhost, toad.com, had massive problems today with sendmail queues, resulting in load averages over 90 (on a machine where 6 is high) and other unfun problems for me to chase. To my knowledge no mail was droped on the floor, but some mail did come out of the machine with headders missing. I have no idea what the mail software thought it was doing by droping headers, but I think we will live even so. I am looking at installing some newer software to deal with the problems of today, though the root causes are solved for now, better software (sendmail) is called for. On the other hand better software is ALLWAYS called for... Guess I had better get back to doing that sort of work... ||ugh Daniel Sysadmin of the month hugh(a)toad.com

1 0

shut up, assmunch
by nobody＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

don't make me slap you again, detwiler.

1 0

True Names and nyms
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some people have argued that there is no way to prevent the use of multiple pseudonyms on the net, that it is possible today and that the new crypto technologies will provide even easier techniques tomorrow. This is an oversimplification, as Tim pointed out. "Is-a-person" credentials can be used to determine whether someone is a "True Name" or not, which is really what Larry wanted to know. Here is one way they might work. (To make this clearer, it is best to think in terms of the equation, pseudonym == public key. A pseudonym is a public key. We think of pseudonyms as being names, like "wonderer" or "sam hill", or perhaps as email addresses, like "hacker(a)univ.edu". But from the point of view of cryptography, these are just frills. The important thing is the key. With a public key, a pseudonym can sign his messages, so that nobody else can successfully pretend to be him. He can read messages sent to him, messages which no one else can read. If he has to switch email addresses he can do so and still maintain his identity by continuing to use the same key. It is his key which is his real identity on the net. OK, back to the is-a-person credential:) An is-a-person credential could be structured identically to the digital coins used in Chaum's simple digital cash proposal. You would go to the credentialling agency and provide some unique form of identification, something that no one else could forge. Today this might be a thumbprint, or in the future it could perhaps be a DNA scan. However, you do not have to identify yourself by name. They don't need to know who you are; they only know that you are a living, breathing human being, one whom they have not seen before. (There could be more than one credentialling agency, but they would all share a database of thumbprints or whatever.) You choose a special public key which you will use for all of your True Name activities on the net. This public key will be used to sign messages which you want to prove are from a real person. Any message sent with that signature is known to be from a True Name and not from a nym. Only one True Name exists per person. Note that this True Name doesn't have to be your real name. If you want to always post under John Q. Public and use this special key for that purposes, you can do so. But you won't be able to post under any other name, including your own, as a True Name, not unless you use that same key. And of course if you do, people will be able to know that you are the same as John Q. Public since you are using the same signature key. The way this is established is that you take your True Name key, which we'll call TN, and do as was done for Chaum's cash: pass it through a one-way function f, and blind with a random number r^3: f(TN)*r^3. You give this to the credentiallying agency when you come in with your thumbprint, and they sign it by taking the cube root. This is f(TN)^(1/3) * r. Back home, you divide by r, getting f(TN)^(1/3). This is your True Name certificate. You can submit it to a public key registry along with TN; anyone can calculate f(TN) and verify the credentialling agency's signature. People will therefore know that this key is the only one belonging to some real person which is signed in this way. Only one such key can exist for each person. So, if people claim to be posting under True Names, they can prove it very easily, by using their True Name key, signed by a credentialling agency. People can still post under as many nyms as they want, but only one gets to call itself True. Note that this solution doesn't reveal very much about the person. Because the certificates are blinded by r^3 when they are signed, even the credentialling agency has no way of knowing which thumbprints are associated with which True Name. (So, actually, it wouldn't be a problem if the agency got your name and address when you came in - this still couldn't be linked with your postings if you didn't want it to be.) Nobody is forced to even use a True Name when they post; they could use nothing but nyms. On the other hand, if people want to reserve certain conferences for True Names only, they can. There is tremendous flexibility to have as much or as little use of nyms as people want. So, people should not be so quick to claim that crypto can only be used to increase anonymity. It is a powerful technology that can be used to increase our control over information in many ways. Chaum's papers continue to amaze me with what is possible. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLM3dJ6gTA69YIUw3AQFmfAP/byAqRUt/R3tQBH5Zg+JYV4u6z2CeJ0eM YOrsvXAptTFjS4TpS177spfoDfGm9gtoL1wyEhwD6gsZ2JhssRXT/7w8MEEzPE2U 9CIOXeBZiL8lSPWBxHBr95jlkJjIZe+v5BWPsWdwmSInk0/vbTaQm4emjNNS9WgG H1jPeYECsjA= =sd2V -----END PGP SIGNATURE-----

1 0

Shocked at my reaction
by msattler＠netcom.com 17 Dec '03

17 Dec '03

The following has nothing to do with writing code, but hopefully posting this will get me back on track.... I wrote this several weeks ago and have been sitting on it ever since. L. Detweiler's contributions of late have made me re-examine my feelings on a variety of email- and cyberspace-related issues. I very strongly believe that everyone has an inaliable right to express themselves, as long as that expression doesn't harm others or impede their ability to express *themselves*. Up to now the amount of trash-mail (as I determine it) has been less than ten percent of my mail, an amount I equate with the real-world equivalent of billboards and junk-mail. L. Detweiler's uncanny ability to craft flame-bait and get the CypherPunks to respond has increased the trash-mail percentage to the point where it's entered my awareness. Torn between respect for someone who has a reputation for having made contributions, worry about someone who seems to have a slim grasp on the reality I'm experiencing, and annoyance at getting scores of ranting incoherent messages, I've made a decision that I've never made before: to put someone (L. Detweiler) into my kill-file. This bothers me a great deal. But there it is. ---------------- To L. Detweiler: I'm sorry, but your style, content, and quantity values have gotten to the point where it seems unrewarding to deal with you. The decision to banish you bothers me a great deal, but not as much as reading your mail does. If you're sincere about the biblical amount of pain you are in, I gently suggest (in my capacity as an EMT with some crisis-intervention experience) that you talk about your pain to a qualified person, perhaps an MFCC. If you're doing all this to get a reaction (for maybe a book) like Don Novello's Lazlo character of the last three decades (and several books), then congratulations. ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 621-2903 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) All that is required for evil to triumph is for {wo}men of good will to do nothing.

1 0

My Views on the Detweiler Matter
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, I. too, am weary of this thread...paranoia, death threats, "pseudospoofing," Satan's spawn, tentacles of Medusa, and on and on. I apologize for the length of this piece, which has reached detweilerian proportions, but I need to make some points. Sorry if many of you are fed up with this thread. I've tried to avoid comment, but I've been getting several rants every day from Detweiler, either posted to the List or in private e-mail (and the rants he sends to Eric Hughes and myself are even more tortured, as he rambles on and begs us to stop tormenting him, to call off our devils who are attacking him, then goes back to threats and insults....very sad). Several people have suggested we "lay off Detweiler," that he is clearly in pain and is disturbed in various ways. I agree, but getting several messages a day from him, filled with threats, taunts, insults, and religious paranoia tends to make this "laying-off" a bit more problematic. Especially when his posts prompt others on this List to try to defend his points. There is always the danger that repeating the Big Lie often enough will cause it to be accepted as the truth. In this case, apparently some are now beginning to believe that the List is in fact controlled by a cabal of plotters and that pseudospoofing is the tool they use to control the mood and agenda of the List. Utter nonsense. He has recently claimed we are a bunch of Ted Bundy's, plotting the murder of young women, that we are spawn of Satan, trying to pull society into the depths of Hell, that we are High Traitors which the government (his newfound ally) must suppress, and that the High Cabal is beaming radio waves into his brain to control his thoughts (only this last item is made up...a taste of what is to come in the next few weeks, I suspect). I consider the whole situation very sad, and even tragic. Lance Dettweiler did some nice work on the "Privacy and Anonymity on the Internet FAQ." Ironically, he now considers my helpful comments on these matters (I recall encouraging him to go ahead and write a FAQ on these matters, sometime last winter or so, so I may have been a prime motivator of his FAQ) to be some kind of evil trickery designed to do whatever it is he thinks is now being done to him. Be that as it may, his recent points require a response from me. And the whole Detweiler matter actually _does_ have some important connections to the Cypherpunks area of interest, so the topic is not as off-base as some might think. Certainly it's closer to our main themes than many of the recent debates about subliminal advertising and using thermite bombs to destroy safes are, to name but two topics. Back to the Detweiler situation. I tried to laugh it off, as my posts of last week or so showed--the one declaring there to be only four or five actually unique individuals on the List, with each of us using dozens of pseudonyms. Little did I suspect that Detweiler would use my joke about the "Wired" photo using hired actors as "proof" of our duplicity, Jeesh, that man needs a humor transplant! His alter ego S. Boxx is still making death threats, as he himself is, and is claiming the "evidence is being collected" for some some sort of formal charges. Right. (That Detweiler = S. Boxx is beyond doubt. Personal mail sent by Eric Hughes and myself to Detweiler showed up in the rants of S. Boxx, and the styles are nearly identical. Detweiler has rather transparently claimed that S. Boxx is "in communication" with him. Right.) Anyway, while I have been mostly just shrugging-off Detweiler's fantastical rants, saving them in my "Detweiler file," some of you are talking about how Detweiler may be ranting, but how he's basically *right* about some things. Some of you are apparently coming to believe that in fact a High Cabal exists to purge Detweiler and to use pseudospoofing to undermine him in public. Now I of course I can see validity in essays separate from the underlying mental sanity of the writer (think of Nietzsche), so I don't automatically dismiss LD's points just on the basis of his paranoid style. But he has presented no evidence for his assertions. I just think he's gone off the deep end with his paranoia about the number of pseudonyms on the List. I know for a fact that I write my stuff under my own name, that I am not any of the more colorful "nyms" on the List....I am not "Deadbeat," "S. Boxx," "Murdering Thug," or "Panzer Boy." (Actually, some of these may just be BBS handles....I'm not paying too much attention to the distinction, as I really don't care overmuch about the "actual" name of folks I haven't met.) To be sure, some people are using nyms, as they have for as long as the Net has existed...and for much longer, of course. Pen names, pseudonyms, whatever. But this is a much different thing than saying the List is dominated by pseudonyms, by clever false identities, by Satan-inspired demons who are adopting false identities specifically to torment good Christians like Lance Detweiler. His modus operandi seems to be to repeat his points over and over again and to to accuse others of Satanic or cabalistic motivations--usually in his inimitably florid prose style--and to claim that the "debate" is being skewed by dozens of phony identities. If Hal Finney is not 100% behind his latest idea, well, then obviously Hal is One of Them, a tentacle of the Medusa, a Nym from Hell that is bent on making LD a laughingstock on the List. In several cases, when Detweiler made some point and others didn't agree with him or actions weren't taken to his liking, he simply stamped his feet and used such effective debating tactics as "I am getting nauseatingly disgusted and TOTALLY angered by the completely traitorous and spectacularly cunning vipers who..." (Lance never met an adverb or adjective he didn't like. Neither did S. Boxx.) (When he was still soliciting my occasional advice in e-mail, which I sometimes gave, I urged him to not try to win arguments merely by repeating his points over and over again and then announcing what his _mental state_ was. His points would have to stand or fall on their own merits, not on his claims that he was going to hold his breath 'til he turned blue. "Blue Nyms"?) THE FACTS There's been a lot of innuendo that "pseudospoofing" is going on. Not just anonymous mail sent to Detweiler--something I can't speak to, not having sent him any and not having access to his incoming mail--but the use of pseudonyms like Jamie Dinkelacker, Nick Szabo, and (as of last night, apparently, according to Detweiler) Hal Finney to shape and slant arguments. Detweiler has argued that these pseudospoofers are criticizing his points and generally interfering with the democracy that would, he thinks, otherwise produce the proper decisions. Namely, his decisions. I've seen no situation where a "vote" of posters was taken, where these alleged pseudospoofers shaped an outcome. In fact, the Cypherpunks list is largely a "market anarchy," with very few real decisions *ever* being made...the several dozen active posters say their points, announce their projects and their progress on same, and generally follow the "coffee shop" model someone (sorry) eloquently described a week or so ago. Positive reputations matter. I've never met Doug Barnes or Karl Barrus before, and they may even be pseudonyms. But I value their comments, regardless. Even some of the recent obvious nyms, like "Sam Hill," I'm valuing more and more. To each their own. Use filters if you don't like nyms. I know for a fact that I haven't been sending Detweiler anonymous mail. And not much mail at all, in fact. About 5 or 6 weeks ago, after he went ballistic and called me a "traitor" and a "lackey of Eric Hughes" over my relatively mild defense of the EFF/Shari Steele advisory, I told him in e-mail I would no longer correspond with him. (My message to him was later quoted in its entirety in one of his rants.) Frankly, I was tired of his hot-and-cold mood swings, with death threats and floridly-written insults interspersed with requests for help in some area (pretty nervy!)....I just got fed up with his obvious lack of social skills and his descent into paranoid schizophrenia. He is, as a former girlfriend would diagnose his condition, a "borderline personality." I've used remailers, though never for mail to him. Detweiler made a big thing about my open admission to him that I have in fact used anonymous mailers at times to post to the List. This is hardly a surprising announcement, as nearly all of you should know that in several instances I have used remailers to make a point, to demonstrate some capability. The three main examples that come to mind are: 1. "Information Liberation Front" (ILF). To illustrate the possibilities, and to also post some articles I had scanned, I began using this "nym" about a year ago. Others have since used it as well (anyone can...no sigs are involved), as I hoped. In no cases can you find the "ILF" doing the kind of "pseuodospoofing" Detweiler rails about. 2. The "A Patriot" (I think that was the name I used) posting supposedly blowing the whistle on F-117 Nighthawk (Stealth) fighter cost overruns. I posted material anonymously, got a bunch of "you are a traitor" messages (not from Detweiler, that I can recall), and then several days later I announced that I was the author and that the material came from widely available public articles. My point was not to make people look like fools--though at least one person did--but to provide a "trial run" for the Real Thing, when actual defense secrets get out on whistleblowers-type networks. It's gonna happen, and we need to think about this in advance. (This posting was made about 6 months ago, and it was hardly a secret that I was the author.) 3. "BlackNet." Ironically, someone else took my announcement of this from somewhere--perhaps from a nanotech meeting, where I used it to illustrate the difficulties in controlling nanotech developments--and forwarded it through a remailer to the Cypherpunks list. But I was of course the author. I've been using "BlackNet" as my generic example of a crypto-anarchic entity since late 1987, as I have already explained in an earlier posting. (The recent announcement that a Van Eyck radiation kit is available via a BlackNet-style "cutout" was not my doing, I hasten to add. I welcome such developments, though I doubt this one is completely serious.) In these three cases, which are my *only* uses of anonymity/pseudonyms that I can recall (I won't say there's never been another example, but I honestly can't recollect any other uses....), these were essentially "open secrets." I discussed all of them either on the List (as with the F-117 and BlackNet material) or it was a standing joke amongst physical meeting attendees that I was behind the ILF. I am not any of the pseudonyms you see on the List regularly. I guess I have too much ego and too little to fear (being retired, I have no fears about my "reputation" as a crypto-anarchist hurting me) to hide my views under a pseudonym. Enough on this, though. Robert Woodhead made some comments in Detweiler's behalf, and was promptly flamed for it, referred to as "another snake" or somesuch. Here are my comments on Robert's points: He writes: >Personally, I am getting a little tired of your ranting. I agreed with >most of your position and got flamed for it. Thanks a lot. It's chillingly >obvious you've read "How to Win Friends and Influence People." > >If you are willing to do the research and provide solid, verifyable >evidence of such nastiness as you are convinced is happening, then >do it. If you are willing to discuss the implications of dishonesty >in a universe of anonymity, then that is a topic of interest. If >all you are willing to do is rant about the boogieman under the >bed, then please do your mumbling somewhere else in cyberspace. > >I _still_ think the issue that concerns you is an important one. I >also think you are doing a very good job of ensuring that people >don't give it critical thought. Robert, Something you might want to think about is this: * I have never sent Detweiler--or S, Boxx, either--a message anonymously or pseudoanonymously. That is, *all* mail I have sent him (and that hasn't been much) has been from my one and only e-mail account, tcmay(a)netcom.com. (Obviously not counting any of the anonymous mail that appeared on the List as a whole, the aforementioned ILF, F-117, and BlackNet material.) * Somehow he became deluded--and that is literally his condition--that other List members, such as Jamie Dinkelacker and Nick Szabo--were pseudonyms of *me*. He ranted at me in e-mail, interspersed with "you sly devil!" congratulations for pulling off such a feat. He claimed I wrote the short story, "Master Key" (about 4-6 weeks ago), which I did not....I don't know who did. The political essays which have appeared under pseudonyms were definitely *not* written by me...some of them I'd like to claim credit for, but I just can't. * After many of these strange messages, I broke my silence with him and sent him a message setting him straight: that I was not Jamie or Nick, that I had not sent him any messages, and that I did not write any of the anonymous pieces he claimed I had. (Detweiler called me a liar for disavowing to him in e-mail that I had written these. He just won't take no for an answer. Denials are taken as further proof of a Grand Conspiracy to Confuse Him.) * This knocked him further over the edge, and he began sending me death threats (along the charming lines of "traitors like you will be hung by the neck until DEAD and then sent to HELL") and other weird messages. * What more can be said? He has taken his personal demon, "pseudospoofing," and blown it out of proportion. When Hal Finney tried to help (a misguided idea, in my opinion, as we are not psychotherapists), he is called another "tentacle of the Medusa" and LD says he now realizes "Hal" is just a pseudonym of his tormenters! When Phil Zimmermann gets fed up with LD's paranoia, he is deemed to be part of the conspiracy! It seems tragicomic that Detweiler has now gone almost completely over to the side long-expressed by David Sternlight (no, I am not making any paranoid assertions) that law enforcement needs require restrictions on anonymity tools, that registries of True Names and identities are needed, and that the Cypherpunks goals are dangerous. He even mixes in fundatmentalist religious paranoia, talking about Satan-inspired Cypherpunks and "black poison" from the depths of Hell. One has to wonder how Detweiler could so demonize Dorothy Denning and David Sternlight and now have so thoroughly taken an even more extreme position on their side of the issues. As someone said to me recently, Detweiler should be regarded as one of the casualties. It's sad. --Tim May. whose identity is all-too-public and can be easily confirmed by looking at photos in past issues of journals like "Transactions on Electron Devices" (January, 1979, paper on "Alpha Particle-Induced Soft Errors in Dynamic Memories") and so forth. I am also known to about 40-60 of you, by my rough estimate. It's sad that Detweiler will not trust the evidence of his senses, and contacts with others, and instead has plunged head-long into paranoid schizophrenia. -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

3 2

No Subject
by Ian Turton 17 Dec '03

17 Dec '03

Authur Chandler writes: > > Isn't it tough enough to build up a rep under our real names? What is > the point to using a pseudonym? I can think of some bad reasons; but I > can't come up with any good ones, except for "fun" and "just to see what > it feels like to put out opinions not my own." I'm sure I'm missing the > point; so, before you jump on me as a Clueless Newbie, can you run by > the reasons why you want to have alternate personas on the NET? Well the one case that comes to mind for me is a friend I knew at a previous university where I worked. There was a member of the support staff who was responsible for introducing the net/email to new users (amongst other things). He had two personas one for dealing with official things and the other obvoiusly an alias (FoFP) for ranting about the government etc. However new users still regualarly reported this alias to Mike (in his official role) for bringing the university in to disrepute. I'm fairly sure he owned up to them at this point :-). However I'd contend that it was important for him to distinguish official posts from unofficial posts more strongly than just by sticking a disclaimer on the end of unoficial messages - since who really reads them anyway. > Ian Turton - School of Geography, Leeds University 0532 -333309

1 0

Re: Net Requlation
by kwaldman 17 Dec '03

17 Dec '03

Say the best way to go is to become a perpetual tourist. That is you don't have US citzenship and thus are not subject to it's taxes and other nosy laws. [Not that other government's don't have nosier laws]. Anyway 1. If you don't have US citzenship, how do you get a passport? (Buy it on sale from the Czech republic or what?) 2. Where do you live? I mean I love to travel but after 3 or 4 weeks of it I'm ready to settle down and hibernate for a long while. [Especially now with a wife and 2 sons, I'd last about 2 days traveling :-)] Somewhere were I don't have to get thrown in jail for thinking the wrong thoughts. [Which given the nature of this list most of us do, except of course our NSA monitors :-)] 3. Are the TELECOM connections there yet? I saw this weeks Economist and it looks promising but last time I was in Europe some of my phone connections were less than perfect. [Even parts of the US leave something to be desired]. I personally need a good phone line (especially if I'm hundreds of miles from my customer), and a minimum of 56kbaud link for my computer. 4. Customer interaction. This is a problem, if you work on computer systems that are unique or program custom software for these systems, customer interaction is very important ( and in other areas I'm sure). Yes email, video conferencing (expensive!) help but you either need to be there or have very good VR (which I have yet to see, this doesn't mean much as I haven't seen bad VR yet either). The one plus is that I believe there is still time (5-10) years before the costs outweigh the benifits of living in the US and thus there is time to plan things like what country to live in, which bank to use in the channel isles and let technological advance solve some of the bandwidth problems. Karl Waldman BTW The above shouldn't imply I disagree with Ducan's premise. In fact I have enjoyed his posts and agree with most of what he says, so I guess I should shut up and buy some DUCAN (or whatever) on HEX. P.S. Ducan please post your talk after you get back from London. I will transfer 1000 thornes to your HEX account (if you have one)

2 1

RSA encryption
by Christopher Kotze 17 Dec '03

17 Dec '03

Does anyone know anything about RSA encryption, if so, please tell me about it ! cheers, chris

1 0

help writing code
by Pat Farrell 17 Dec '03

17 Dec '03

I've spent the summer working on a SMTP/POP client that runs under MS-Windows. There are two ideas behind it. First, widespread acceptance of global communication will require that mass market user don't have to learn vi/emacs/... and Second, once the email composing and reading is done on a local, controlled PC, we can trivially pipe messages in and out of PGP, RIPEM, or your favorite encryption algorithm. This second part will allow folks to send all their mail encrypted, which will not only spread the word, but hurt traffic analysis. But, I need help. I've got all the front-end stuff working, and can handle the SMTP/POP protocols. But I can't get Windows to talk reliably with a raw async link. (I don't want to require SLIP or PPP, as lots of sites are too clueless to offer it.) I need a robust communications library. It has to do as well as possible given an inherantly inreliable link. I've bought three commercial sibraries, and none work. Cypherpunks write code. I've been trying. If someone wants to help, please reply, and we can work out detailed specs of the API I have in mind. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Re: More signs that key escrow is coming
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >Things seem awfully quiet on the list the past 24 hours.... > >Lucky Green wrote: > >> This RFP contains the final specs for a new multimedia architecture the >> cable companies intend to deploy. >... >> ".c4.11.7.1.1 Security System Objectives: >> The Offeror shall specify [..] whether it is possible to hide information >> in the digital signature number of which the signer would be unaware, which >> could conceal information. " >> >> Such as parts of the key? > >This sounds like it's a concern about subliminal channels in the >DSS/DSA signatures, a la the concerns raised by Gus Simmons last year. >I don't know what the use would be, unless it's concern (by whom?) >that viewing preferences could be back-propagated. > The RFP is not just for a system that sends Multimedia to the subscriber. The specs call for Homeshopping, private financial transactions, encrypted credit card transaction, etc. Just what info do they intend to conceal that the "the signer would be unaware" of? Just wondering, -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

1 0

Security of PGP private keys
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

PGP secret keys are protected by a password. Yet people have said that one should not keep one's secret keyring on an insecure machine. Why? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

5 4

Re: Security of PGP private keys
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: jrk(a)sys.uea.ac.uk (Richard Kennaway) > > PGP secret keys are protected by a password. Yet people have said that one > should not keep one's secret keyring on an insecure machine. Why? > > -- ____ > Richard Kennaway __\_ / School of Information Systems > Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia > uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K. 1. Why take chances? Once the evil intruder has the file, she can throw test passwords at it from now till doomsday and might be able to crack it. 2. On shared machines, there are ways for users with the appropriate access to read your keystrokes (like, for example, when you type in your pass phrase). Anyone with that access should also be able to grab your secring.pgp with no problem, and that's that. --Dave.

1 0