December 2003 - cypherpunks-legacy

Re: FYI: Eudora and PGP
by merriman＠metronet.com 17 Dec '03

17 Dec '03

> > > All of MacPGP 2.3v1.1, MacPGP2.6ui, and Viacrypt PGP 2.7 can >be driven via the use of AppleEvents, by the macpgp kit. This leads >one to believe that all three use the same suite of events. My >scripting environment is broken, so I can't actually test to see that >the entire suite is the same. > > The macpgp kit can be found at >duke.bwh.harvard.edu:/pub/adam/mcip Now, if there was just something for us PC Eudora users...... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Update of Secure Edit a0.3.3->a0.3.4
by Thomas J. Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- UPDATE/PATCH OF *SECURE EDIT* for Mac FROM a0.3.3 to a0.3.4 (AND MAILING LIST NOTICE) There was a bug in Secure Edit a0.3.3 that would cause it to crash when setting a default startup pass phrase on 68k macintoshes, but not power macintoshes, which is what I was testing it on. I was not planning to release any upgrades before a major update and release in which I would overhaul most of the program, including changes advised by Colin Plumb and others. However, I thought this was important enough to release a patch. I have uploaded a patch to upgrade a0.3.3 to a0.3.4, as well as a a0.3.4 package, to ripem.msu.edu in the directory /pub/crypt/mac. These correct the bug. However, please save your work regularly as well as before using this feature, just to be safe. I am overhauling much of the program completely for the next release. The method for verifying the default password has also been changed from the previous "baroque" method. Now, it takes the MD5 hash of the key, encrypts this hash on the key, and uses the first 8 bytes of the resulting ciphertext to validate the default startup key. Please report any problems/suggestions/improvements you may have regarding Secure Edit. Also, if you wish to be on a list of email addresses that will receive information about Secure Edit updates or other Miyako Software releases, please send me an email to that effect. Anonymous IDs are, of course, fine. No code will ever be sent by email. Actual programs and source code must be FTP'd from ripem.msu.edu Miyako Software tjb(a)acpub.duke.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLt4R708YjrUhOUC5AQE0dQP7BvOWvOe6B1edvJ07RJ60UodPXoYAOmOX DQ6AueVoqrfcYqvstaHQrHl/9V6Ie9P9KbQLdxlHk7CbIsyKgdwOs5YOmUSYB01V YeIpp1YYkNa/ztpdcREtIGA4ghQMU/ijU7Ni6b/kLiITTSMr4HUosvBVEpMkh9Bw 93J/BzpvpO4= =m0R+ -----END PGP SIGNATURE-----

1 0

Tim May is RIGHT!!!
by Anonymous User 17 Dec '03

17 Dec '03

I'm sorry I can't say so under my real name, but I *vehemently agree* with Tim May about the authoritarian, heavy handed, generally outrageous egotism of Eric Hughes of recent. This is REALLY UPSETTING. Eric should be ASHAMED OF HIMSELF for strutting around like a peacock. he is EMBODYING THE DICTATORIAL APPROACH HE CLAIMS TO DEFY VIA CYPHERPUNK PHILOSOPHY. this is truly the most HYPOCRITICAL AND EGOMANIACAL action I have seen by anyone in recent times on this list. Tim May will leave the list? GOOD FOR YOU, TIM. Get the hell out of here. Eric Hughes may have had some good ideas ONCE UPON A TIME but hasn't kept up his end of the bargain of the cypherpunk agenda for a LONG, LONG TIME. just a WASHED-UP HAS BEEN, who defies the very ideals that he claims to espouse in the most dictatorial manner possible. oh, what's this? you're just going to DELAY the messages that don't have signatures? well, I'm sure the government would just love to slightly DELAY THE MAIL of people who don't have the proper ESCROWED KEYS. what's this? you aren't going to move to any more "serious" measures, such as actually BANNING UNSIGNED MAIL, at least, NOT YET? oh, THANK YOU, MR. ALMIGHTY GOD OF CYBERSPACE. ah, I'm sure Louis Freeh feels the same way---we aren't proposing any minor change that PREVENTS YOUR FREEDOMS, are we? gosh, the government is starting to look awfully nice in comparison to the TYRANNY OF A DICTATOR. this scene is getting REALLY STALE. oh, Mr. CYPHERPUNK FOUNDER, please tell me once again how you started this list, and how the volumes of posts by the public are really YOUR PERSONAL PROPERTY, and this is YOUR LIST. we are your "guests"???? BULLSHIT. any host that treats his guests like this is NOT A HOST. this is not graciousness but the crabby and cranky bossiness of a STELLAR INGRATE and a EGOTISTICAL JERK.

3 2

ERIK HUGHES: EGOTISTICAL PRICK
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

what is all this @#$%^&* about MANDATORY SIGNATURES ON THE CYPHERPUNKS LIST? who is Eric Hughes, DOROTHY DENNING??? who is going to force ME how to use cryptography??? a CYPHERPUNK??? this is BULLSHIT. eric hughes is a TRAITOR TO THE CYPHERPUNK CAUSE. it's so transparently obvious, this is nothing but a big ego ploy. "Look at me!!! I am cool!!! I have accomplished virtually nothing substantial in any cypherpunk area for a long time, all my major recent projects are failures that have gone nowhere, I don't follow my own rules of 'code, code, code', not 'blather, blather, blather', and this is one way I can stroke my ego and show off my utter brilliance in the lack of anything useful!!!" has he written one smidgeon of code to back up his ideas? NO!!! he has philosophized and pontificated about his IDEAS that he is PLANNING to put into code. frankly, I see absolutely NO EVIDENCE WHATSOEVER of the perseverence required to build a solid foundation in this noisy bozo. he flames away against the people who are REALLY doing something. what is this about "founding" the cypherpunks? no one is my leader, I am not a part of a movement that takes credit for MY hardworking accomplishments as glory for "founders". why don't someone ask him why he went to go work with Chaum a long time ago and CAME BACK. I'll give you a hint: HE DIDN'T CUT THE MUSTARD. ask him why he hasn't graduated from college!! hint: HE DIDN'T CUT THE MUSTARD. he is paralyzed by his own perfectionism straightjacket, rather than building SOMETHING that works haphazardly he builds NOTHING that works AT ALL. oh, so he built a remailer. BIG DEAL. what kind of brains does it take to call sendmail with a message? to cut off headers on a file? good lord, how many commands in SED is this? so he wrote it in PERL??? *wow*, I am *really* impressed now!!! this is BS!!!! let's find a NEW LIST. a list is a COMMUNITY PROPERTY. anyone who pulls this kind of prickery, insinuating they are in the "bully pulpit", deserves CYPERSPATIAL EXCOMMUNICATION for HIGH TREASON TO THE CYPHERPUNK CAUSE of TOTAL AUTONOMY FOR THE INDIVIDUAL.

3 2

autodecrypting incoming mail
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've been fooling around with scripts which automatically decrypt incoming mail, and I'm curious about how others are approaching the problem. In particular, I'm interested in how Mime gets mixed in. A problem with using a script which acts as a PGP aware pager to display mail is that it would choke on certain types of Mime data, an attached binary, for example. The best solution to this problem would be a PGP aware Mime mailer, but that's too hard for me, so I've been playing around with scripts which will transform mail spool files with cyphertext in them into mail spool files which are all plaintext. First of all, I'm assuming that premail was used to encrypt the mail automatically. To try to get a handle for what's going on with the headers, I've been sending mail from elm, pine, and /bin/mail and seeing how they vary as encryption is added. When encryption is used, premail always uses Mime headers, with a Content-Type field that says "application/x-pgp; format = mime". When encryption isn't used, elm doesn't use Mime headers, but Pine does. There are a few other differences between the various mail programs as well. Elm, for example, has header fields which say how long the body is, while Pine doesn't. This makes me wonder if the transformation that premail uses on outgoing mail is a reversible process. Is it possible to transform a mail spool file so that it's exactly as it would have been if premail encryption hadn't been used? It's pretty obvious that we don't need it to be completely reversible: all that's needed is a header that will match the plaintext body. But what factors need to be considered when the new header is constructed? Specifically, which header fields would have to be modified? Signatures complicate things further, because they add information to the letter which has to be included in the plaintext somehow. If the same letter is sent twice with the same software, one signed and encrypted by premail and the other sent normally, it's not good enough to transform the first into a copy of the second. Somehow the user has to be told if the signature checked out. Is it possible to add a Mime section that would contain this information? Suppose, for example, we use Pine to send a letter. The letter contains normal text and an attached binary. This would mean that it would contain two sections in the body. Does it make sense to decrypt the letter, check the signature, and construct a new three section body, with the added section containing the results of the signature check? If we do that, how can we make the mailer display it? I'm sorry to ask so many basic questions, but I don't know much about Mime. I started using elm a long time ago, and I've stuck with it because it's comfortable. I don't have a lot of experience with Mime mailers. (If anyone could suggest a good cutting edge unix Mime mailer, I'd appreciate the pointer: I think just using the software would help a lot.) Thanks, == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt6FUxEpP7+baaPtAQGbrAQAoWCj9ilFdE59fj+6beOYdv8MGQ3BtlMP ClfdJkQhbUheJx+vKtlvfw3/Cz8qiHpxy0QHqLbXzpTKrdN36xp1IbnAmFDGoFBz pjaBZdLMI/Izjein6aeardeKnwnhgVC1X6jgrQUhYfRsa0fHzx1Hl9PXucgckHHn gkQKsuIauR0= =82Jv -----END PGP SIGNATURE-----

1 0

NYT Potpurri and Econo-cash
by jya＠pipeline.com 17 Dec '03

17 Dec '03

[This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.] -----BEGIN PGP SIGNED MESSAGE----- John Markoff writes today on an interview with Michael Spindler, chairman of Apple. Here're some tidbits: "And flirting with heresy, Mr. Spindler says he sees no need for the so-called information superhighway. And 500 channels? Sixty are plenty. 'This is not going to be an all-electronic world where we all sit on a couch and are force-fed a constant stream of information,' said Mr. Sindler." "Mr. Spindler took pains to contrast himself with two of his industry's rivals -- and vaunted visionaries -- William H. Gates, chairman of Microsoft, and Andrew S. Grove, chairman of Intel. 'They believe that just because of technospeak it's going to happen, but it's not,' said Mr. Spindler." "And yet, Mr. Spindler, even as he decries the industry's preoccupation with the so-called vision thing, acknowledges that there are still ways of improving the life of the computer user. 'We still have to switch our computers on and off,' he said. 'We go to the restroom, and when we leave it flushes automatically.' " And, on Mr. Schindler's daring mis-speak, note others today parlaying technospeak and adverting profitably in The Times just like the Forbidden Fruit: "I.B.M. to Replace Pentium Chips in Some Machines" [Company News] "Takeover Talk Pushes Lotus Shares Up", by Glenn Rifkin. "A Challenge to Microsoft in Interactive TV", by Lawrence Fisher. "Prodigy Testing Link to World Wide Web", by Peter Lewis. "I.B.M. Makes Board Change". - ------------------ For those yearning to see the November 26 not-so-short article on e-cash in The Economist mentioned here twice and lavishly praised by one reputable cpunk: Send blank message with subject: ECO_do. [If remailer hks.net is a sucker punch I'm hit.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt6KLioZzwIn1bdtAQFv0wGAo5bKL0EOmdTpYtQ871U/ZU1b6rPiCidL JXWT+yggmo7oPFn+avTw+EtrTl8fCn0A =mb5r -----END PGP SIGNATURE-----

1 0

Re: public accounts / PGP / passphrases
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:18 PM 12/01/94, lmccarth(a)ducie.cs.umass.edu wrote: >Could someone please elaborate on the foolishness of using PGP with a >passphrase on a public machine (as I do) ? Am I wrong in thinking that my >secret key is useless to an intruder until she guesses my passphrase ? I >have no net access except via an account on a public machine, so I'm not >about to start storing my secret key elsewhere, but I'll change my passphrase >to <null> if it's irrelevant anyway. I just reviewed the PGP docs a bit and >Phil says "Nobody can use your secret key file without this pass phrase.", >which seems to contradict what many people on the list have said. Theoretically, your sysadmin could quite easily get ahold of your passphrase, through a number of means, including logging all of your keystrokes. As a general rule of thumb, the sysadmin can do anything. I'm also don't have the crypto-math knowledge to know whether it's easier to crack your IDEA-encrypted passphrase then it would be to crack your private key only having some ciphertext and perhaps some corresponding plaintext in your possession. It certainly would be easier to crack your passphrase if you use a bad passphrase, like an english word. Generally, I think you don't want your private key falling into the wrong hands, passphrase encrypted or not. So if your sysadmin actually wanted to, your sysadmin could get at your key. Now, obviously this doesn't mean that your passphrase might as well be null. Nor does it mean there's no reason to use PGP at all if your only option is using it on a time-shared machine. I have a feeling that many people who don't know better think one of these two things after seeing all of the messages on this list that say "Don't use PGP on a time-shared machine! It's useless!" It's not useless, although you are losing some security by doing so. It's only a false sense of security if you don't understand exactly how much security you are losing. [and admittedly, I don't understand _exactly_ how much, myself. But then, I'm not using PGP on a timeshared system at the moment.]

1 0

Re: public accounts / PGP / passphrases
by Rich Salz 17 Dec '03

17 Dec '03

> >Could someone please elaborate on the foolishness of using PGP with a > >passphrase on a public machine (as I do) ? Am I wrong in thinking that my > >secret key is useless to an intruder until she guesses my passphrase ? The sys admin can change the kernel running on your machine. A special kernel can be built so that when a particular user is typing on a tty and the executing process is named "pgp" then all keystrokes they type are recorded into a file for the administrator to read later on. The local machine must be part of the trusted computing base. /r$

1 0

PGP Sig Proposal
by VAMAGUS＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have never posted to this list before because I am rather new to it. What bothers me is that as a Hardware Technician it is the Cypherpunks that inspired me to flagellate myself at my keyboard while invoking the deity of Borland in ANSI 'C' to compile my source code. Ok, so it never works but the idea of the Cypherpunks has made me a (limited) programmer none the less. *Not* signing messages because you are asked to flies in the face of the purpose it serves. To spread the word about PGP and, as it has done, uncover any difficulties that may still exist in the propagation and utilitization of PGP. In actuality the amount of mail that suggests the difficulty in performing PGP signing should be a call to all Cypherpunks to start coding. Instead, like a child that has been asked to play with a favorite toy, there is refusal based soley on....I won't do it because you asked me to do it. Forging signatures is a waste of resources that could be better spent finding ways to smooth the path for PGP and similar encrypting/signing implementations. If I want to be anonymous I will use CHAIN and go thru a remailer. My .sig and PGP sig say the rest. ***************************Frenchie Sends*************************** * Key ID: BEB3ED71 J.Francois PGP Key on Request* * As soon as any man says of the affairs of the state * * "What does it matter to me?" the state may be given up for lost. * * J.J.Rousseau - The Social Contract * ****************Want to know more about PGP? Ask me!**************** -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt6IjrbmxeO+s+1xAQEo8AP/e1L7c/GGHqoRMQ0OyoA0nVyMvbVo3CdP UmAqFhR4V0D4nXnK0PFZqKrkBzJDxpvCb5mJSS4F6KAnMl6Oa5aq055g/9GHEPZb RvDEiraxcJ8y6vwOfrhxyOrDxX/2/g3sHds9lekBDc71Z72FS6Ix3A1KJjI+o2hP HSx6rt+qHc8= =UOH6 -----END PGP SIGNATURE-----

1 0

RE: Re: ERIK HUGHES: EGOTISTICAL PRICK
by shawn leas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- shawn leas writes: > > In article <199412020536.VAA08584(a)jobe.shell.portal.com>, > > <anonymous-remailer(a)shell.portal.com> wrote: > > >this is BS!!!! let's find a NEW LIST. a list is a COMMUNITY > > >PROPERTY. anyone who pulls this kind of prickery, insinuating > > >they are in the "bully pulpit", deserves > > >CYPERSPATIAL EXCOMMUNICATION for HIGH TREASON TO THE CYPHERPUNK > > >CAUSE of TOTAL AUTONOMY FOR THE INDIVIDUAL. > > I list is not 'community' property. Just like if you tryed to say that > my money was your community's property (Clinton supporters) I'd probably > cut your head off. Eric has full rights to go so far as to kick you off > if he feels fit. Or me, for that matter. Whatever, it's HIS LIST. I clipped the wrong line and made it look like I was replying to a guy who was replying to the original guy. A public apology is in order, because noone deserves to be associated with the dick who flamed Eric. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt+V1aZRyOzqm29xAQECMgP/d0BDw40DVx9LJ4+BBGAHXiIb0D1mGnK3 3HVU01f3tE0AZ6iZnsTK+jg3K22szCXo1e6QoMjyqWIWsF7H1Bj+H/iEHF5rjp9l krbBExPG88Q4qnAm5kgEVpWK0z0L7uBe8EU1ni+UaD1VXSUM8EM1hjehFzEfwRJM /ZXSDNCV8Wc= =P72R -----END PGP SIGNATURE-----

1 0