December 2003 - cypherpunks-legacy

PGP Docs in HTML???
by Claborne, Chris 17 Dec '03

17 Dec '03

I am currently working on turning the PGP documentation into a HTML document with clickable table of contents.... Someone has probably already done this. I am doing it here for my "Security" home page at AT&T GIS San Diego, mainly for educational purposes. Do you know of anyone that has done this? If not I can post somewhere when I complete. It's a big task. ... __o .. -\<, chris.claborne(a)sandiegoca.attgis.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

2 1

Re: McCoy is Right! New Mail Format to Start Now.
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Perry Metzger writes: >Sorry, Tim, but this isn't true. I know people who still own VIC-20s >that can't handle 80 columns. Also, users of ASR-33 teletypes might be >left out by the requirement to handle full ASCII. I was using an >ASR-33 full time only 15 years ago. 15 years ago, I was a 9 year old in the fifth grade who called the teacher a "nasty" name and was told to write 500 sentences as a reprimand. I asked if they could be typed, she said yes. So, I prompt;y went up to the 40 column display on the Apple IIe and wrote a four line, Apple Basic program that would repeatedly print 500 sentences saying, "It is not right to call the teacher names." When I handed it to her, she new she'd been set up. That didn't go over well as I remember. Anyway, that's not really what I wanted to say. I wanted to say that as a company that writes a Mail package. One of the biggest complaints of our customers has been lack of MIME support. Also, we have been severely "wrist slapped" for not formatting our mail messages to 80 characters so "normal people" could read it on their mail readers. So, my point, the market right now is for MIME support and user setting message widths. You can't please everyone all the time. >Now, I know that all usenet postings in Japan these days use ISO-2022 >encoded characters, and MIME and all that, and that people in Russia >use similar methods to carry their stuff, but they are just >bounders. Japanese characters are considerably different. I've been on some Japanese news servers that you just can't read with a normal news reader just because they require graphical Japanese characters. (Kanji, Katakana, or Hiragana ... depends on the group.) By the way, I was testing a news reader, I can't read Kanji. -- Brad >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

1 0

Re: properties of FV
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> This goes back to the two kinds of anonymity that you so usefully > defined in your earlier message. These small transactions would > have counterparty anonymity -- all that the seller knows is your > first virtual id, which is essentially a user-chosen pseudonym -- > but not issuer anonymity. That would make this counterparty pseudonymity, not anonymity. The merchant, while not knowing the true identity of his clients, is still able to correlate the transactions of individual accounts (and must be able to under FV's policies). A malicious merchant, for instance, could recognize that a particular account is more interested in certain types of information and charge accordingly. andrew

1 0

Re: properties of FV
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from fv: 15-Dec-94 Re: properties of FV Andrew Lowenstern(a)il.us. (718*) > > This goes back to the two kinds of anonymity that you so usefully > > defined in your earlier message. These small transactions would > > have counterparty anonymity -- all that the seller knows is your > > first virtual id, which is essentially a user-chosen pseudonym -- > > but not issuer anonymity. > That would make this counterparty pseudonymity, not anonymity. The merchant, > while not knowing the true identity of his clients, is still able to > correlate the transactions of individual accounts (and must be able to under > FV's policies). A malicious merchant, for instance, could recognize that a > particular account is more interested in certain types of information and > charge accordingly. Good point. I stand corrected, at least as far as the terminology is concerned. However, as far as the particular malicious-merchant scenario is concerned, I must say I'd be skeptical about any merchant who didn't tell me the price up front, *before* he asked me for my account-id... -- Nathaniel

1 0

Re: McCoy is Right! New Mail Format to Start Now.
by Amanda Walker 17 Dec '03

17 Dec '03

Tim May writes: > "Actual" terminals is not the issue, but "virtual" terminals *is*. > I haven't done a poll lately, or ever in fact, but my hunch is that 70% > of the list is emulating some form of terminal, e.g., a VT-100 or 102, > or maybe something slightly more exotic. Or a shell program, as in > America Online, which has its own standard. I'd actually be interested in a poll, but I know better than to actually ask for one :). > Perry made the same point that Amanda makes, that my Macintosh _should > be_ usable as a graphics system, not just for ASCII text. Well, I > agree, but so what? I have to admit some bias here--our flagship product for the Macintosh contains a very MIME-aware mailer (which I am working on making crypto-aware as well), and which was designed to make MIME seamless. No helper software, no extracting pieces and finding a viewer for them, it just works. > I note that all of Perry's messages, and most > of Amanda's messages, fit this ASCII model. In my case, it's because I intentionally make them fit. Most mailing lists have a general expectation of plain ASCII. When I send mail to other people at InterCon, I (and the recipients) see something that looks like any other Mac document--nice formatting, diagrams and screen shots displayed inline, and so on. And when someone sends me a file via email, even if they're not using a MIME mailer, it shows up as an icon I can drag to a folder in the Finder. This isn't really a commercial for my product, though :). This is how I think MIME was meant to be implemented, and it's analogous to how I think encryption should be implemented. Forget helper applications, macros, and so on. There should be two popup menus on the envelope: "sign with" and "encrypt with". When you select them, you get prompted for your passphrase, and it just works. This is the same direction that other commercial vendors are headed, and it's this kind of simplicity that I think will finally get people to start using the technology (just as with MIME). On this, I suspect the Netscape folks and I are in violent agreement :), as probably are you from some of your comments to this list... > (The MIME stuff I'm not saying shouldn't be used, just that some of > us--perhaps most of us, is my hunch--will not be adopting the > latest bleeding edge technology. Right now, PGP is more of a bleeding edge technology than MIME is, IMHO. > Finally, Amanda mentioned "being away from out desks." Well, many of > us are _always_ away from our desks when we post. From home machines, > not from T3-connected Indigos on our desk. Indeed, that's why I brought it up; at the moment, I'm sitting in my study at home posting over a dialup (14.4K) PPP link. I've also posted from 37,000 feet sitting in a DC-10 (in coach :)), with my mail being queued up until I could jack into a phone when I land. > One thing I would like very much is the ability to include simple > diagrams and drawings in my posts, but this is clearly an _ > unsolved_ problem, from a practical point of view. Hmm. I'd say it's a partially solved problem. Newsgroups like clari.features.dilbert are popular enough that there's at least a significant fraction of people who can handle MIME messages with embedded graphics. > and ask yourself where all these posts-with-diagrams are > if they're so easy to do.) Well, I could start posting some, if you want existence proofs :)... Amanda Walker InterCon Systems Corporation

1 0

The End of the Forged Post Controversey
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It would appear that the "Bob Rae Forgery" had its standard 15 minutes of fame: From: eye(a)interlog.com (eye WEEKLY) Newsgroups: eye.news,ont.general,alt.internet.media-coverage Subject: EYE.NET: Mike Harris -- Roasted Alive Followup-To: eye.general,ont.general,alt.internet.media-coverage Date: 14 Dec 1994 11:00:20 -0500 Organization: eye -- Toronto's Arts Newspaper Lines: 160 Approved: eye(a)interlog.com Message-ID: <3cn4qk$ec0(a)gold.interlog.com> NNTP-Posting-Host: gold.interlog.com Summary: Ontario PC leader pulls net.related bonehead political stunt Xref: io.org eye.news:307 ont.general:20751 alt.internet.media-coverage:2470 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY December 15 1994 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ EYE.NET EYE.NET MIKE HARRIS: ROASTED ALIVE Clueless PC leader mercilessly flamed for net-related political stunt by K.K. CAMPBELL On Dec 8, provincial PC leader Mike Harris stood in the Legislature and introduced a copy of a post to the newsgroup ont.general -- a public forum where anything of general interest to Ontarians is discussed. The post in question was signed "Bob Rae." It talked about the sexual orientation of Marion Boyd, the Karla Homolka case, and a few other things. Harris wasn't claiming Rae actually wrote it, he was suggesting it was proof of a serious "security violation" in government computer systems. Simulataneously, the PCS issued a press release entitled "Our Premier: Roadkill on the Information Highway." We regularly warn Our Faithful Readers about eyeNET's Rule#1: When strangers approach wielding the "highway metaphor," run. Do not speak with them. Do not make eye contact. Last week, eyeNET predicted many new and entertaining adventures could result from Ontario's premier getting online. We expected the shenanigans would come from anonymous net.weenies and assorted loons, not Mike Harris. ARTIFICIAL BOB It began innocently on Sunday Dec 3, at 1:22:41 a.m. (EST), when an anonymous individual posted a message called "Greetings to People of Ontario's Information Highway" to ont.general . It was faked so the "From:" line said "premier(a)govonca.gov.on.ca", Rae's office. Ontarians read it. Ontarians ignored it. The general response was best summed up by Toronto's Val Dodge (val(a)io.org) who wrote: "Am I the only one getting tired of [these spoof posts]? OK, the first couple were funny, but this is getting really tedious." No one thought it was from Rae. No one thought it was from "hackers invading government computers." Netters just looked at the PATH line and could see the post worked its way to Ontario from a California computer. On top of that, in the header it plainly says: "This message is NOT from the person listed in the from line. It is from an automated software remailing service..." Fake posts are part of net.life, but this one wasn't even a "forgery" (a real attempt to pretend to be someone else), it was a "spoof" (an "imitation" no one is expected to believe). A parody. Hardly a "security violation," unless Harris thinks all political impersonators represent "security violations." What if terminally dense Americans thought impersonator Dana Carvey really _was_ George Bush? Oh my GAWD! Call the cops! Rae's staff had noticed the fake post. Like the rest of the net.community, they just ignored it. After all, even the stupidest elements of the net community hadn't been fooled... why worry? They didn't account for Mike Harris. Five days later Harris issued his now famous "Roadkill" press release which includes the line "Internet Bob: the hacker is hacked." PC press secretary, Peter Varney, told eye the Conservatives weren't trying to score political points. They sincerely thought this harmless post was a "threat to Ontario's security" -- though Varney couldn't explain why Harris attempted to grandstand. And it's exactly that attempt to make political points from the matter that most angers Ontario netters. Sensationalization and playing on the ignorance of the press (which was as rampant as ever). The PCs swear they never saw the very explicit disclaimer in the fake Rae post because the newsreader of the person who "slipped" them this oh-so-dangerous document edited out most header information. It's plausible -- many newsreaders chop stuff from headers (headers contain info to help direct and organize posts for ease of reading). But ignorance hardly excuses Harris. In our conversation, Varney, trying to save face, actually suggested the simple ability to make a spoof post (and fool Mike Harris, I guess) is still a "security threat." So what are they asking Rae to do about it? Call in the OPP and stormtroop around cyberspace? THE NET STRIKES BACK The net.community's responses in ont.general have been a virtually unanimous condemnation of Harris. Several threads (i.e., discussions) developed, the longest one entitled "MIKE HARRIS IS SLIME." It originated with Brampton's Evan Leibovitch (evan(a)telly.on.ca) who wrote he didn't blame the "impersonator" because "children will be children", but "the people who fed this item to Harris are absolute assholes... My respect for Harris and the Ontario PCs has just taken a nosedive, and I hope the scum who were behind this realize that they have scored *NO* political points for pulling this stunt." In another thread, Toronto's Jamie Mason (g1jmason(a)cdf.toronto.edu) wrote: "Anyone who has been on the net for more than about FIVE MINUTES would realize that the message was a forgery. Anyone who has been on the net for more that about TEN minutes wouldn't even take notice of the message." T. Kim Nguyen (kim(a)algorithmics.com) likened the Harris bluff to "the way he paraded the woman quitting her job to go on welfare last year. His antics of the last few weeks trying to make the NDP look bad have simply succeeded in showing how much of a ridiculous opportunist he is." GENUINE BOB Late Friday afternoon (Dec 9, 5:24 pm), the Premier of Ontario (premier(a)govonca.gov.on.ca) issued his first real post to ont.general. It was called "Thanks" and read, in its entirety: "Many thanks to those of you who flamed the PC pranksters. I knew when I went online that I would have to deal with fake posts and related chaff. That's the price of being on the Net. I'm not about to delete my account. I still want to hear from people with *real* concerns and *real* suggestions." Signed: "Bob*The Genuine Article*Rae" eye called the premier's office. They confirm it's real. The premier's office made it clear it won't launch any investigation as to where the parody post came from -- and for that it should be applauded. I've talked with many people who don't understand the net and when something they don't like happens they invariably respond: "I'm going to shut the Internet down!" The Rae team is doing it's best to fit into the net.community, not remake it. Varney, on the other hand, says the PCs will actively pursue anyone who "impersonates" Mike Harris online. FRESH ROADKILL! Oh no! Look! Just spotted in ont.general! A breach in PC security!! Alert! Alert! Call the newsmedia! On Dec 10, "Mike Harris" supposedly posted a missive called "Mike Harris Fights Back - Kiss My Ass Rae!" to the net. It reads, in part: "You listen here Rae, my sources informed me that your article was on the level. You sleazy NDP wimps are more than capable of resorting to cheap shots like this, so I thought I'd pin one on your grain-fed ass... DAMN I'm mad!!!" Signed: "Mike Harris, Progressive Consevative (sic) Party of Ontario." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Retransmit freely in cyberspace Author holds standard copyright Issues of eye in archive gopher://interlog.com Coupla Mailing lists available http://www.interlog.com/eye eye(a)interlog.com "Break the Gutenberg Lock..." 416-971-8421 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLvD223BFBj7pSNyhAQElcwf/Yv79UuYHOa8YJHDpZGHp8GlmD7WpoddK HaUr/EHvGJdB18UaSX99lZtLVDErFdrgk1xVvXQbIYAeLFpd1SmxMDUAqKUjqcMJ 4zZbqR7hKS66D++MRCWE/JCrxyEcyQPGXDNEXRel4XQZBv83FKI6qsLTccLfYaQN zozSr7CLjvM7Fv877znvLYQ/wvcvBRO4B1yCbj++/ENP4o7xL/BXSeoWYMJcdcFO X+qTqNj4b3A1YU6Phc5ciTHy/UeOUAtyWDAXXDmswXAkwDPWBUT3f0twJcIzjiRP RzkYASYIa21DYxhiR89vWL7NfcfnLYj7YHuG3Rc83wZLaxMhNLPCKw== =RZZ8 -----END PGP SIGNATURE-----

1 0

rng & program docs. programs
by Gary Jeffers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dear Cypherpunks, 1. I need a good DOS software random number generator for a crypto project of mine. Can anyone give me the ftp site & other d/l info. of something good? 2. Also needed, is some software documentation tools. - shareware or free. Here's the problem: I program in PC Assembler & C & although I program structured & use modules, I find that when I have a lot of subs that if I pick out anyone of them, that I have a hard time relating it to the rest of the code. That is to say: if I start out with say 3 major modules & have them call subs that call subs that call subs, then when I examine anyone sub, it is hard to understand its relation to the rest of the code. Anyone recommend a program with an ftp site or have any helpful info on this? Yours Truly, Gary Jeffers Following is my military grade public key armored. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy7wt2IAAAEEALQ+0QCeQIMNCBGQtZxPtLE1z9ltqDVCy5h6tpic6RsmgcFS kp92CV3Vptmr7/jqb+SMJ8HUYV7XAz1I1sDEjYrJ3vP9UZh0gTlUDW/lEosZ8mjH ott/uurW9hw8/nPnQNRzcJIHpdkcHtjJwvTB4v5BBr94oKy7JthOFCSMI5OVAAUR tC5HYXJ5IExlZSBKZWZmZXJzIDxjY2dhcnlAbWl6em91MS5taXNzb3VyaS5lZHU+ =+0yw - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLvC599hOFCSMI5OVAQF+wwP+IIIuNJD9grm+YhhhkcOeKEi0+aFI253a rW1JaBblgCOEHBuQmyfbeRqRIPHz5PUZat2u0WcSmzgX6CH4B2rEggUTZ/vBss7e o7fCNKGLebFQ690iV+B70WG/7+cp9jqYAwbfJSLuDubD8oLFvOr9/4EPTo/oEFLz FwM40K8w3M4= =nkPn -----END PGP SIGNATURE-----

1 0

Re: FV & PGP (was Re: First Virtual email security)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks for the clarification - I missed that part. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvDgUCoZzwIn1bdtAQEyiQF/edj0wFAtJz50I9VQpRFpz7pMFKL6ffIo /QiLNqjus8bKRStqz5hr2obb8w7OoBlw =JFF+ -----END PGP SIGNATURE-----

1 0

Many-Hop Remailer Ping Messages
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Some agent periodically sends out several hundred line remailer ping messages (unencrypted) with many hops planned; a sample is included below. It would be nice if the parties responsible would remove my address (and, for example, Eric Frias' address and the leri address) since I'm not operating a remailer at this address any longer. Adding in the newer remailers might be a wise move if this is supposed to produce results representative of the entire remailer bramble. In the immortal words of Kibo, "PLEASE UPDATE YOUR COSMIC PARAMETERS." Thanks. - - -L. Futplex McCarthy Forwarded message: > To: lmccarth(a)ducie.cs.umass.edu > > :: > Anon-To: remailer(a)ideath.goldenbear.com > > :: > Anon-To: remail(a)leri.edu > > :: > Anon-To: efrias(a)csugrad.cs.vt.edu [many lines omitted...] - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvDfr2f7YYibNzjpAQEIygP/cQrEeELKjsqFjzEj7vD7R0/NfZQ52H8G WhHF+11aQfYN+XJYKv/Ah8/ifyxHNhwjaidk3GS3IEkVganOUv7Ay3ax4HsZiR/J vkSKL0tW7YB2ZM4faL+Z4y71P6190VzERu4Wsuku89KLxEhGvSLGSZQOQamK3LgG 938B9PolQmg= =gyVz - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvDg/ioZzwIn1bdtAQG6mgF+IxsKDp5IhQnSGEivFBuXBhX7lS44Unvs DKzub0n5Zsu/D1cSAAKGoE8zYUXQq4mi =U3vB -----END PGP SIGNATURE-----

1 0

re: MIME
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> Once you've seen a secretary who barely understands anything drag a > spreadsheet into a mail message and send it to someone on another > continent who, equally ignorantly, just double-clicks on it and then > has the spreadsheet program launch, you will understand what the point > of MIME is. Is this what the big deal about MIME is? Damn, I've been doing this (cutting and pasting spreadsheets, launching them by double clicking) for years now on Mac's and PC's running Windows. Heck, under NeXTSTEP as well.

2 1