December 2003 - cypherpunks-legacy

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Thu, 15 Dec 1994 06:55:23 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: KEYSRVR: tabula rasa? Cc: Philip Zimmermann <prz(a)acm.org>, Michael Graff <explorer(a)iastate.edu> -----BEGIN PGP SIGNED MESSAGE----- [parts from a separate thread w/ Derek] Why is it possible for someone other than ME to add MY key to a keyserver? I realize that at some point (perhaps only the first time you submit a key?), there has to be some trust model employed, but it seems like this anyone-can-submit-anyone-else's-key situation offers a very obvious attack: anyone could propagate bogus keys across the net by just generating bogus keys with someone else's email/name on them, leading to massive impersonation problems. Maybe I'm missing something obvious, but it seems like there should be a more rigorous method available to, and employed by, keyserver operators for verifying someone's identity before accepting a key submitted (supposedly) by them. Shouldn't the key submission msg itself at minimum be required to be contained within a signed msg from someone with enough "nearness" in trust levels from some trusted introducer known to the keyserver op? I thought this sort of situation was precisely the reason for the trust level system in PGP in the first place. This may be a can of worms (or not), but if cpunks require fairly decent methods for verifying the identities of people who want to trade keys with them personally, then it seems keyservers should require at LEAST that level of verification (or better). I'd like to CLEAR/REMOVE ALL keys from ALL keyservers that are: - attributed to me by others (without my knowledge) - added by others (unknown to me) - purporting to have been generated by me) and start with a tabula rasa. Maybe in a few weeks, once all these (what I consider to be) bogus keys are GONE, I can add my actual key to a keyserver. There doesn't seem to be any elegant mechanism available for doing this yet, but I'm ready to be educated on this point. Any comments? dave -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLvANraHBOF9KrwDlAQGVDwQAs4/OuwICvnl+hHpatlcpp8o7MrF21x9f 4SJd0NUJ/koa648bDwr0qxyhs7NSwon2jU4FPI/QBPVAcrsSAMkfXWr2NpF6pOlV TIFIQ9xouT9RP7KT86bU0EiU3RQsO3q8LJRjylWOA2zBEYC+b7Ah5ALfZ/tng293 wE8W2E/rxl0= =64dw -----END PGP SIGNATURE-----

3 2

Re: properties of FV
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> > That would make this counterparty pseudonymity, not anonymity. > > The merchant, while not knowing the true identity of his clients, > > is still able to correlate the transactions of individual accounts > > (and must be able to under FV's policies). A malicious merchant, > > for instance, could recognize that a particular account is more > > interested in certain types of information and charge accordingly. > > Good point. I stand corrected, at least as far as the terminology > is concerned. However, as far as the particular malicious-merchant > scenario is concerned, I must say I'd be skeptical about any merchant > who didn't tell me the price up front, *before* he asked me for my > account-id... -- Nathaniel Of course, but what if you bought something from a Web server, revealing your account-id to the server. A smart server could adjust the prices on pages that haven't been retrieved yet. I don't know if this is necessarily possible with hhtp (i.e. does your client always use the same return port number for requests during a given instance of the client? <bear with me, I don't know the real details of http>), but you get the idea. Worse, linkability of transactions also allows the merchant to do 'payment traffic analysis' in an attempt to determine the real identities of it's clients. Many merchants can get together and compare transaction logs as well... These 'attacks' are a feature of any payment system that has only counter party pseudonymity (as opposed to anonymity), not just First Virtual... andrew

1 0

FV fine print
by eric＠remailer.net 17 Dec '03

17 Dec '03

In looking over the FV docs, I found the following interesting tidbit. ---------------------- * YOU shall retain computer data of all sales for at least three years from the date of the transaction. In the event you are not able to store such information, you may contact infohaus-info(a)fv.com to make storage arrangements. ---------------------- Interpretation is left to the reader. Eric

1 0

Re: FV fine print
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from fv: 15-Dec-94 FV fine print Eric Hughes(a)remailer.net (403) > * YOU shall retain computer data of all sales for at least > three years from the date of the transaction. In the event > you are not able to store such information, you may contact > infohaus-info(a)fv.com to make storage arrangements. > Interpretation is left to the reader. FYI, this is a direct carryover from the standard terms & conditions of a Visa/MasterCard merchant account. Basically, this is a legal necessity to process inquiries from the cardholder's issuing bank, etc. You'll note that we don't say you have to provide the information to us, merely that you have to keep it -- that way, if there's a court action requiring us to provide the information, we can point out that you are required to have the information. If you haven't kept it, you won't have nearly as much of a problem with us as with the government. In any event, the most we can do is say, "oh, you violated our terms and conditions, you can't be an FV seller any more." What we're doing here, in essence, is allowing ANYONE to function as a Visa/MC merchant, with the addition of the 90 day hold and a few other things. In order to do that, our terms and conditions have to ensure that you comply with the Visa/MC terms and conditions, that's all. -- Nathaniel

2 1

Re: Less Flaming, More Civility
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> C'punks, when this list started we were a bunch of idealistic privacy > freaks. Look who's on the list now: the developers of cutting edge Internet > software. The two are not necessarily mutually exclusive :). And from this point of view, I have to say that for all of my complaints about the specifics of various things Netscape has put forth, I cannot fault them for trying to improve the status quo. One thing that everyone has in common here is that we all believe that the issues we discuss are important, and that it's worth trying to solve the problems. This is in part, I think, why tempers flare from time to time--I know this was true in my case. Amanda Walker InterCon Systems Corporation

1 0

Re: PGP 2.7
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 15 Dec 1994, DNA wrote: > I keep seeing pgp 2.7 in public key & sig blocks. > > Where do we get it? Viacrypt. It is the commercial version of 2.6.x - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvB4nyoZzwIn1bdtAQFBKgF8Cpy4syrgzPe7Q4vQ7elW/7gvcK+3rfwJ byzKrS8TF7rwL1eLiVZfW+qolOyMB2TG =svxJ -----END PGP SIGNATURE-----

1 0

voice over SLIP?
by erc＠khijol.xmission.com 17 Dec '03

17 Dec '03

This might be somewhat off-topic, but could someone send me a list of ftp'able software for doing voice over SLIP? I'd prefer linux-based software, but DOS-based would work, too... Thanks very much! -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi ** PGP encrypted email preferred! ** "What's the use of distant travel if only to discover - you're homeless in your heart." --Basia, "Yearning"

1 0

Re: FV & PGP (was Re: First Virtual email security)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 15 Dec 1994 nsb(a)nsb.fv.com wrote: > Moreover, if we supported PGP today, we might indirectly lend > credibility to what we perceive as the incorrect belief that > cryptography is NECESSARY for commerce. Because we see cryptography as > helpful, but not necessary, we aren't going to support PGP right away, > but will probably add such support when a large enough portion of our > customer base wants it and can make use of it. Without cryptography how exactly are you going to protect my credit card numbers from sniffer-snoopers and crackers? Either you will send the credit card text in the clear, or it will be encrypted somehow. Or perhaps you will have customers call you over the phone to give you their credit card info? - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvB6FCoZzwIn1bdtAQE9PAF/W2kx2n8l+Qz9Z/51MVQqjjPgGPdQRK8p WFPmh42CywQKiUjjg2qhqPrmzzz6V91r =6zTt -----END PGP SIGNATURE-----

2 1

Re: MIME (again)
by Michael Conlen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 14 Dec 1994, L. McCarthy wrote: > I'm using a version of ELM which claims to be MIME-compliant and usually is, > but all I saw in Peter Cassidy's message was a collection of random-looking > extended-ASCII characters. Usually when something arrives in a locally- > unsupported MIME format (like Amanda's GIF a while back), I just get an > "unrecognized format" error message. I didn't see any error messages at all > this time, just a meaningless jumble of characters (different, incidentally, > from the PGP-cipherptext-like characters Tim quoted). Thats what that thing was susposed to be. I got the same things with pine, which I know is susposed to be mime aware. Anyway all this talk about it gave me an idea. A PGP mime extention, where your mail says that you have a PGP encoded message, enter secret pass phrase to contiue. I think this would do a couple of things First get PGP installed on more machines. Sys Admins who install MIME aware applications would almost be required to install PGP beacuse it is a part of MIME. Secone more people would be introduced to PGP. The first time they use a MIME aware application ie. PINE they would be given a message that they do not have a public/private key set up, ect. That time could be used to explain the basics of encryption, public/private key's, and security issuse of using PGP. Third PGP would be more frequently used beacuse it would be right there with there E-Mail, ect. It would not require as much work to set up beacuse the programs could prompt to do things ... Do you want to encrypt this E-Mail with the recipiants public key [Yn] ... Groove on dude Michael Conlen - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvCAzyoZzwIn1bdtAQFCnQGAi19XGrhhoUi7gaAJnG6UUeUjUqvX9yL+ m7qc768s3wEs5sdEqY2mT+JVCT1ES3PB =tQFE -----END PGP SIGNATURE-----

2 2

Re: FV & PGP (was Re: First Virtual email security)
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Excerpts from fv: 15-Dec-94 Re: FV & PGP (was Re: First.. NetSurfer(a)gold.chem.hawa (1237*) > Without cryptography how exactly are you going to protect my credit card > numbers from sniffer-snoopers and crackers? Either you will send the > credit card text in the clear, or it will be encrypted somehow. Or perhaps > you will have customers call you over the phone to give you their credit > card info? We NEVER put your credit card number on the Internet. It is entered ONCE via telephone, and after that it is never needed directly -- people sell you things using your FV account-id, which does not have the same security properties as a credit card number. For more information, please send mail to info(a)fv.com or check out our web pages at http://www.fv.com. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvCB4CoZzwIn1bdtAQHLuAGAzvgG7jYAqpyHC/HD2NCmN3DkxnCeGT6J 3opxp30Uyo0T/5me04hlzvYe4A6IEDbA =yQOr -----END PGP SIGNATURE-----

1 0