December 2003 - cypherpunks-legacy

Warning about Pegasus Mail and PGP (fwd)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Forwarded message. From: investor(a)flood.xnet.com (Investortools) Newsgroups: alt.security.pgp Subject: warning about PMail-PGP Date: 9 Dec 1995 00:47:46 GMT Organization: XNet - A Full Service Internet Provider - (708) 983-6064 Lines: 5 Message-ID: <4aambi$e33(a)flood.xnet.com> NNTP-Posting-Host: cyclone.xnet.com X-Newsreader: TIN [version 1.2 PL2] I just installed the "Open Encryptor" PGP interface for Pegasus Mail. I found that when you sign a message and queue it, it stores your password in the clear on the hard drive. Apparently it doesn't sign or encrypt the message until just before transmitting it. So it stores your PGP private key password with the message until it sends it.

2 1

Re: .PWL spin
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 09:11 AM 12/9/95 -0800, Joel McNamara wrote: >Microsoft said it plans to strengthen the encryption, Bennett said. >Password data will be stored randomly, making it harder to find on the >computer, he added. Oh that is clever! (Security through obscurity!) Make it all the harder to back up the file! I had the minimal amount of security W95 allows one to have by having the default user not be able to do anything, then the me user to everything (for which you needed a password...) Of course my registry got corrupted (eudora beta for W95) and the only damn thing it did remember was that the default user couldn't do anything, and it no longer knew who I was... So now, I don't even bother with that, I'm just hoping securdrv, sfs, or something makes it to W95 one of these days... (I doubt either of those will make it...) _______________________ Regards, It is absurd to divide people into good and bad. People are either charming or tedious." -Oscar Wilde. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: The Elevator Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 12/8/95, Jerry Whiting wrote: >A group of us have been wrestling with a problem and I'd like to ask for some >outside help. We've come to call it the Elevator Problem. > >Alice and Bob want to establish a secret in from of Eve. In other words, >they want to agree on a secret key in an elevator full of Eve's. Isn't this just the "subliminal channels" scenario? Originally phrased in terms of prisoners under the watchful eyes of their jailers nevertheless establishing a private communication channel? Schneier describes this beginning on page 66 (of his 1st edition). Your scenario looks identical to this. So you should check out the papers on this in the Crypto Conference proceedings. As to whether you can implement this without using patented algorithms, I don't know. Not enough information given. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

Re: CP: Mailing List Subjects
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995, Michael Handler wrote: > Learn procmail. It'll save you hours upon hours of time. > > :0: > * (^From owner-cypherpunks(a)toad\.com|^Sender: owner-cypherpunks(a)toad\.com) > lists/cypherpunks Would the following work?? :0 * (^From|^Sender).*owner-cypherpunks(a)toad.com |/usr/bin/contrib/procmail -m ~/.punk_rc Does anyone know where the procmail archives are?? That might help some of us out, especially those of use who are lousy at managing our very, very precious resources. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

ideath remailer temporarily down
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The remailer located at remailer(a)ideath.goldenbear.com is currently unavailable because the local freenet (which handles DNS and MX service for goldenbear.com) is making some configuration changes. Apologies for not warning anyone, but I didn't get a warning either. Incoming mail for goldenbear.com should be spooling on sender's machines; I haven't received any since late Thursday (12/7) evening. I don't know when they'll get this fixed but I'm kinda pissed off about it and am exploring alternatives. Doh. I'm reachable as gbroiles(a)darkwing.uoregon.edu as well. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMofY33YhjZY3fMNAQG7rwP/cLSbiqtDCm1frYSOqxTIitTaP/36v/7g W+azO+zC1+k6ozWaGwcCqtgwi2Kmbv/XtCnDbzzQdSI6k0rJFwhbw5rDkxQ4W5sQ 9PNHO9UC1F7JyAEs7kTiZSxZpkqRdzx98P06wRfy4Hwkzy7OuoYm2jHYNlHDojcv 9Jx6wYWVlIo= =QLxL -----END PGP SIGNATURE-----

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by Siberia 17 Dec '03

17 Dec '03

Okay, here's how I understand things with PGP and Pegasus. You have two options with Pegasus depending on the set-up options you choose. You can either send upon completion of your out-going email, or you can have your mail queued until you press the send out-going mail button. The actual PGP process does not occur until you actually send the mail. So the answer would be: don't queue your mail. On 9 Dec 95 at 16:24, Jon Lasser wrote: > On Sat, 9 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: > > > I just installed the "Open Encryptor" PGP interface for Pegasus Mail. > > I found that when you sign a message and queue it, it stores your password > > in the clear on the hard drive. Apparently > > it doesn't sign or encrypt the message until just before > > transmitting it. So it stores your PGP private key password > > with the message until it sends it. > > Can anyone verify this? > > Kinda brings new meaning to the term "Open Encryptor," huh? > > Jon > ------------------------------------------------------------------------------ > Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 > Visit my home page at http://www.goucher.edu/~jlasser/ > You have a friend at the NSA: Big Brother is watching. Finger for PGP key. > > > Namaste' Kimberly Long klong(a)phoenix.net What is life? It is the flash of a firefly in the night. It is the breath of a buffalo in the wintertime. It is the little shadow which runs across the grass and loses itself in the sunset. ~Crowfoot 1821-1890 )O(

1 0

Re: Netscape announces position against GAK
by Frank Stuart 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net (Timothy C. May) >Subject: Re: Netscape announces position against GAK > >Credit where credit is due. > >I for one am satisfied--and even pleased--with the Netscape position on GAK. > >It remains to be seen how steadfast Netscape, as the major player in the >Web browser business, remains in the face of (likely) pressure from the >government. > >It seems to me that we have have been quick to criticize Netscape--which is >good, the quickness part--and thus we should be equally quick to praise >them. To be sure, various of us might've written the Netscape position >statement slightly differently, but this does not change the basic point: >that Netscape has come out against the Administration's position on GAK. > >For this they deserve our praise. I agree with all of Tim's sentiments (well, in this message, anyway :>). I'd especially like to thank Jeff Weinstein for his hard work keeping both us and Netscape management informed. I think he's done us both a great service. To avoid just saying "me too", I'll throw out another idea on making the U.S. version of Netscape available to U.S. users over the Internet. How about a phone number to call to get an access id of some sort that can be used to FTP the software. When you call the number, you can use caller-id to verify that the person is calling from within the U.S. You could set up a BBS-type system to do this automatically, or make the phone number a 900 number and charge a few dollars to cover your costs. You could also set up the access id so that it can only be used once. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

2 1

Re: Warning about Pegasus Mail and PGP (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 9 Dec 95 at 18:29, Siberia wrote: : Okay, here's how I understand things with PGP and Pegasus. You have two : options with Pegasus depending on the set-up options you choose. You can : either send upon completion of your out-going email, or you can have your mail : queued until you press the send out-going mail button. The actual PGP process : does not occur until you actually send the mail. So the answer would be: : don't queue your mail. That's not really a solution in the Windows environment, if you have a swap file, you never know what gets written out to it. The solution is run w/o a swap file or run an encrypted file system. I run an encrypted file system. Pegasus will indeed save your key with your message in the outgoing queue. This is a problem with the design of pegasus, not with the design of the add on encryptor. : : On 9 Dec 95 at 16:24, Jon Lasser wrote: : : > On Sat, 9 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: : > : > > I just installed the "Open Encryptor" PGP interface for Pegasus Mail. : > > I found that when you sign a message and queue it, it stores your password : > > in the clear on the hard drive. Apparently : > > it doesn't sign or encrypt the message until just before : > > transmitting it. So it stores your PGP private key password : > > with the message until it sends it. : > : > Can anyone verify this? : > : > Kinda brings new meaning to the term "Open Encryptor," huh? : > : > Jon : > ------------------------------------------------------------------------------ : > Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 : > Visit my home page at http://www.goucher.edu/~jlasser/ : > You have a friend at the NSA: Big Brother is watching. Finger for PGP key. : > : > : > : -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMpJNDUjeCeeebC9AQFsdAf+OY1FPLqSbHYyB+MnUl56dau9gFouoLKf y5UDCE9d4w2ndo6iKOGk7UzfTR3vYQaJmfEI2og+37hi2au01mHm/T0IAUOFYOYr owr6Xn8TZ8vHPOEe71LYRdad60ZdlkPr7H3Nxc9l7O9ueZp0SAM4xPMZmMPUkb8V d4j2m1kbLOHHNmqFmHWjxXvKLaowF/38cgbV9VuDFatySZuM9TdaVQEbazum0uDE LOgUzrQqs2GqlDOB1WMkvJv947SPHhjCJQTcygtS6SoGJv6AzLCL0LtstmBnCOgI zRIrX5wgFSp49BRdmE0/xp62+TuaGCZ6ml8iW/zS9ab7GSeOA2Qs6Q== =GINp -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Animals can be driven crazy by placing too many in too small a pen. Homo sapiens is the only animal that voluntarily does this to himself.

1 0

test
by Anonymous User 17 Dec '03

17 Dec '03

this is a test of the cypherpunk w3 anonymous remailer interface. author is N..... B...

1 0

Re: More FUD from First Virtual
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 8-DEC-1995 16:15:52.58 At 02:52 PM 12/8/95 -0500, Jon Cooper wrote: > The US government can stop it. It is irrelevant what *should* stop >it, but it's extremely useful to note that the US government's political >climate of paranoia and FUD in general will certainly not allow truly >anonymous cash systems inside of our country in the forseeable future. But who's going to ask? If an anonymous payment system springs up outside the US, we can use it as a store of value if nothing else or for shopping overseas. Domestically, we can convert non-anonymous payment systems into semi-anonymous ones. What counts is difficulty of transaction and market demand not legal structure. Thus, about five minutes after the "temporary VISA card" travelers check substitutes are issued, I can start selling them for (discounted) cash to all comers. Likewise Ecash laundry servers letting anonymous people use non-anonymous Ecash. It remains to be seen how much customers value anonymity. There should be a niche market in any case. ---------------------- I would also add that what one is doing when trading digital cash is bartering for information. While the government has been successful in placing limits on point-based bartering systems such as recordkeeping and taxes, the lack of central books will make it quite hard to do so for digital cash. Trying to outlaw barter arrangements, when what is being bartered is an apparantly random string of numbers, is quite simply not going to work. -Allen

1 0