December 2003 - cypherpunks-legacy

Re: Netscape gives in to key escrow
by Jonathan Zamick 17 Dec '03

17 Dec '03

>I they tell you about it and you buy it anyway -- tough luck. > > >Same with the cars. Would *you* buy Pinto with explosives in it???? >(leaving aside the "inherently dangerous" argument for the moment on the >products liability claim). > >EBD Hmm. The key point is that almost no general users will have a clue what actual security is, and what GAK is. They _might_ understand the risks of having an explosive in their vehicle (but can just as easily argue it wasn't properly designed if it went off improperly.) Regardless of what they'd know about their vehicle, they can easily claim to had the risks associated with GAK improperly represented, Netscape misleading them with deceptive claims of security given this potential hole etc. I'm not saying whether or not this is the case, but we are very much in a legal period where individuals are in fact expected not to need common sense, and corporations are responsible for cleaning up after consumer stupidity. It is certainly true that given the general state of education regarding crypto, the average consumer can easily say that regardless of warnings about GAK, that they weren't properly informed of the risk. With all the hype around security, Netscape and encryption people will be under the impression regardless of one little disclaimer tag, that their information is safe. Neither government nor corporations will disabuse them of this belief. The case would be strong against them as a consumer. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

4 4

Re: Barring access to Netscape
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 1 Dec 1995, Ed Carp wrote: > I believe that Netscape uses "Mozilla" as their keyword when > exchanging browser-specific information. An interesting side-effect: It seems that the Microsoft browser also sends "Mozilla". - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBML9iryoZzwIn1bdtAQHrkwF5AQ/6ldj1MG7JA05l7wOJw5MebvCvGEok zTfJg30NjNK8MLStXz2fGuDhMMs2ZIHJ =VVSJ -----END PGP SIGNATURE-----

1 0

(fwd) Re: SKIP domestic Source release is available
by Adam Shostack 17 Dec '03

17 Dec '03

A while ago, someone was asking after Sun Microsystems-Russian crypto connections. This tidbit was in sci.crypt, in a message with Message-ID: <DIwxqo.7zu(a)ipmce.su>. www.elvis.ru/english/portrait.html has some on the Sun-Elvis connection. Adam >AFAIK, an international version of SKIP was developed in Russia, in >Sun parthner Elvis+. Check www.elvis.ru. I beleive one may this >implementation of SKIP outside of U.S., for example in Russia. -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

nsa and netscape (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > From: "Bob Bruen, MIT Lab for Nuclear Science" <BRUEN(a)mitlns.mit.edu> > > The following came from a government source. I thought it might be of > interest. > Bob > -------------------------------------------------------------------------- > > At yesterdays FNC (Federal Networking Council) meeting it was > mentioned in passing that NSA has given Netscape a grant of $5 Million > (yes $5M) to beef up the security features of Netscape. More info will > be forthcoming on this. > I found my way to http://www.fnc.gov, but the most recent documents that they had online were about three weeks old. I, too, am curious what the source for this was.

1 0

Updated lists
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For those of you that use the Mixmaster type2.list and pubring.mix from vishnu.alias.net for your mixmaster clients, I have just made some changes to these files on vishnu. You may want to update accordingly. John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! Packet Radio - KG5RG(a)WA4IMZ.#SETX.TX.USA.NA WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBML9o2lOTpEThrthvAQGCTgP9F0kt6INVXFMZVg1Q+/yyoukhg8BJF8M7 PnGr8XoO0nc8oLWcNbQSG66oXQuDESNhMg6+/MoZzcmT6NKral1Gr7KCRqDuYX+/ O6JMmipO0NSqKwn7HPkDi7HSEc0g5gGsdp53y+3OXYi+KrYLcDjs5ov22D0ryTun jfksXFfEBrw= =cdZU -----END PGP SIGNATURE-----

1 0

Re: [NOISE] Barring access to Netscape
by Herb Sutter 17 Dec '03

17 Dec '03

At 14:26 12.01.1995 -0500, Robert A. Rosenberg wrote: >If you want to see one way of locking out Netscape users, check out this >URL which points at a Web Page that will not allow access by Netscape Users Just a personal note... while I am strongly in favour of security, this seems rather petulant and knee-jerkish. JeffW: Please add a configuration option to let users override the "Mozilla" ident, so that they can continue to use Netscape at all sites. I personally won't use the override, though; if a site is going to insist on trying to frivolously exlude me as a user based on nothing but the browser I choose to use, they aren't serious anyway. >(the guy is ticked off at them trying to establish their own standards) - The _market_ establishes standards (been proven time and time again). His reaction sounds pretty childish to me, but YMMV... Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

2 1

RE: digital receipts and cash
by Ali Bahreman 17 Dec '03

17 Dec '03

I have a paper on "Certified Electronic Mail" which I feel helps in your quest to create "digital receipts". See my home at www.eit.com/~ali for pointers. The paper was published at the 1994 ISOC Symposium jointly with my thesis advisor, Doug Tygar. Regards, Ali

1 0

Aware's radiation detector
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

This month's Scientific American has an ad by Aware for that serial port radiation detector we were discussing a while back. Upper right corner of page 109, I think. Sells for $149 US, 45 day money back guaranty.

2 1

The ecash protocol (for real)
by Ian Goldberg 17 Dec '03

17 Dec '03

Well, they did it. Probably quite a few people are sending something to this effect to CP right now, and we're crossing paths. Check out http://www.digicash.com/ecash/protpublish.html. Analysis is forthcoming (I'll probably have something useful to say by the December Bay Area meeting...). - Ian

1 0

Re: Netscape gives in to key escrow
by Jonathan Zamick 17 Dec '03

17 Dec '03

>And thus we return to my original point, which is that it will depend on >what is said/disclosed. If every copy of GAKscape had a banner, bigger >than the Netscape "N" which said, "The government can read every message >you send using this software no matter what you do" then I think >consumers will be hard pressed to say they weren't warned. I don't mean to be inflamatory, but it isn't much of a point. They aren't going to put such a banner up because that would limit their business. The goal of Netscape (though I don't single them out), any corporation that would profit from business of those who seek encryption while still allowing GAK, and the government, is to limit the public's awareness of the size of the hole. If they let people know the extent of the hole, then they'll use products w/out it which blows profits from companies involved, and doesn't benefit the government who want it in common use. >I disagree. Almost nobody read the fine print on the back of a note you >sign when you buy a car or otherwise take out a loan, but the provisions >are generally enforceable ... Ignorance is not necessarily an excuse. The question is whether there was false representation of the security of the product. 1. The general knowledge of encryption and secure electronic financial transactions is significantly lower than that of more standard transactions. 2. Applying for a loan or buying a car involve actively going out, negotiating, signing contracts, etc. It will be much simpler to simply stick your vital info into a 'secure' browser. 3. The choice of browser to use will be done, based on representations by companies about the security of their product. If Netscape doesn't explicitly state in direct terms when accessing the browser that the GAK is a potential security risk, then they will be sued. Simply because someone will get blamed. Since they (or again any company that incorporates GAK.. I really don't want to target Netscape in specific) will make the threat sound as insignificant as possible, and not bring it to people's attention (and they can't afford to do so) when (not if) it is breached they will be taken to court repeatedly. > >EBD Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

2 1