December 2003 - cypherpunks-legacy

Smart Bombs
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Smart Use for Smart Cards "UBIQ announced that its software has been selected by American Express to personalize smart cards that will be issued ... for ticketless travel on American Airlines. ... Airline travelers with these smart card holders will be able to proceed directly to an airport gate, insert their smart card into a gate reader, receive seat confirmation, and board the plane without touching a single piece of paper. "Traditionally, smart card technology has been associated with user authentication for computer systems or as an electronic alternative for cash. This announcement takes the best of both worlds and looks to provide a potentially innovative use for smart cards. ... Copyright (c) 1996 Zona Research Inc. Of course, not having a card may subject you to greater scrutiny at check-in time due to the reduced tracking ability. James

1 0

No Subject
by Henry Iskandar 17 Dec '03

17 Dec '03

Please unsubcribe me from your list Creating Place Medan - Indonesia ebrandt(a)idola.net.id

1 0

No Subject
by Michael Mattsson 17 Dec '03

17 Dec '03

UNSUBCRIBE

1 0

Re: HAPPY GUY FAWKES DAY!
by Duncan Frissell 17 Dec '03

17 Dec '03

>The Beefeaters (the guards who still wear their traditional uniform) >searched the basement, saw barrels and barrels of gunpowder and a long >fuse. At the end of the fuse was Guy Fawkes. They either did the search >late on November 4, or early in the morning on the fifth. The powder had spoiled because it had been stored too long without being turned over. It wouldn't have blown up in any case. DCF

1 0

Re: News: Europe Wants Stronger Encryption
by Ernest Hua 17 Dec '03

17 Dec '03

> I don't understand why don't they just use PGP, or something like that. > There is no patent on it? IDEA is patented in Europe. It takes a lot of time to test out and "break in" new encryption algorithms. If you invent one, surely the first thing you would want to do is to patent it, right? Well, that is exactly what everyone's been doing so far. Few, if any, actually let their stuff go to the public domain. Kudos to Bruce S for Blowfish ... Ern

1 0

Re: FW: Dr. Vulis is not on cypherpunks any more [RANT] (fw
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

> Hi all, > > There is one important legal aspect which the operator of the Cypherpunks > mailing list has opened themselves up for with this action. In short they > have now opened themselves up for defamation and liable suites by imposing > an editorial policy on the contents of this list (1). First of all I support John's decision. However, these types of actions make it difficult to further any common carrier legal development. As most on the list will agree, we would like certain content freedom on the Net. When the SPA discussed thier contributory infringement we all cringed (especially those running small ISPs). My point is that this decision should be based upon anything but content. Arguments can be made that the Dr. "asked" to be removed by techincal means. Arguments can be made that the Doctor abused remailers (assuming a writing analysis can identify him and that "abused" has any definition 8-). Saying that the Doctor was decreasing the S/N ratio IS content based restriction. It DOES open up the door. > This opens up the potential, for example, for Tim May to sue the operator of > the Cypherpunks mailing list now for posts from users (even anonymous ones) > which defame or otherwise liable his character, reputation, or ability to > pursue income in his chosen field. In short the operators of the list > becomes publishers and distributors of the material. It is the legal > difference between a bookstore and a book publisher. While I wish he was wrong, I have to agree. > Censorship is censorship, irrespective of the source of the limitation. > Free expression is impossible in an environment of censorship. The right to > speak not only implies a right to not speak, it also implies the right to > emit complete mumbo jumbo. The actual content of the speech is irrelevant. That is not completely true in the USA. Content can and is restrained. You cant yell "FIRE" in a crowded theatre. Commercial speech is restrained. And, yes, sexually explicit language used on a jobsite is effectively restrained (I am a discrimination lawyer, believe me, it is). > I have argued in the past that this list is a defacto public list because of > the way it is advertised and to the extent it is advertised. All the protests > by the operator to the contrary will not convince a court. All of the "advertisements" and their "extent" are totally irrelevant. John does not advertise. Members might. So what? Am I to understand that if I get enough people to tell others that my favorite privately held company is really a public one that I can then have a court force them to make an IPO? It is private, it is controlled by John, not the government (unless that white van outside his house is actually filtering his packets 8-). > > Hope you folks have a good lawyer. > Very happy to volunteer my services. > (1) ;login:, Oct. 1996, V21N5, pp. 27 > > > Jim Choate Matt -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDq+FoAAAEEANM9+JcJmUp4aCSGpdOG4Y1b6m4630XA8H41Utbvr7Tr6wEH CD6tlxZ+k+Pycj4w/f8WQa8fC50skoLjUNeP4lYsR7NYaMGRp6WkqCLMI/3Nohvk pfLDqnzZZdwVL2liB7mfTURoF6doQaVehHmMBjSaVTfD12tzNGm6VvyEc77JAAUR tClNYXR0aGV3IEouIE1pc3pld3NraSA8bWptaXNraUBleGVjcGMuY29tPg== =lkx1 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Information [for new PGP user]
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:08 AM 11/7/96 -0800, Dale Thorn wrote: >stewarts(a)ix.netcom.com wrote: >> You can read and compile the source code yourself. > >[snip, snip] > >Really? All 60,000 or so lines, including all 'includes' or attachments? > >I'll bet you can't find 10 out of 1,000 users who have read the total source, >let alone comprehended and validated it. Depending on the system, compiler and version of PGP, compilation may or may not function as expected. I have had a number of odd problems compiling the code for the PC over the years. (It has always compiled easily on the Unix boxes I have used.) The "gorrila" version on the Cypherpunks FTP site does not want to compile at all. (It wanted specific libraries that were not in the version of the compiler I was using.) Microsoft's compiler had a few odd problems as well with some of the earlier versions. (I think I was compiling PGP 2.6 with VC++ 7.0.) Also, you have to have the compiler in the first place. The latest compilers are getting pretty big. (100+ megs!) Most people either do not have the disk space, the money for them (or do not know where to get free ones), or the needed arcane knowledge to get the compile to happen at all. (And if there was a subtile bug in the code, most people would not be able to find it. This includes many programmers.) BTW, there is a Windows95 console version of the International version. (Check out http://www.ifi.uio.no/pgp/download.shtml for versions available.) It is the "non-us approved" version, so use at your own risk. My problem with PGP is that there is no protection for information on what keys are on your secret keyring. It would be quite possible to create a program that read the keyring and saved off the names of all nyms and truenames it found there. (It would make it quite easy to then find out that "Nym X" is associated with "User Y".) And with Active X, it could be offloaded to a remote site without anyone being the wiser... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

(Fwd) Re: Euro Key Escrow
by Peter Trei 17 Dec '03

17 Dec '03

>From the SSL-users mailing list. ------- Forwarded Message Follows ------- Subject: Re: Euro Key Escrow To: ben(a)algroup.co.uk Date: Thu, 7 Nov 1996 13:42:16 +0100 (NFT) Cc: cypherpunks(a)toad.com, ssl-talk(a)netscape.com, ssl-users(a)mincom.com, ietf-pkix(a)tandem.com, ben(a)gonzo.ben.algroup.co.uk From: um(a)c2.net (Ulf =?ISO-8859-1?Q?M=F6ller?=) > It is, apparently, true that the EC is considering schemes for key escrow, by > "trusted third parties" There is an extensive survey at the European Cryptography Resources page, http://www.modeemi.cs.tut.fi/~avs/eu-crypto.html The EU commission's group DG XIII has been discussing key escrow for quite some time, but they have not yet been able to agree on a position. Jerome Thorel has posted some rather scaring interviews with EU official David Herson who is in favor of a key esrow scheme. Victor Mayer-Schoenfelder reports that crpyo regulation is likely to be delegated to the more liberal DG XV. A number of member states, such as Denmark, very unlikely to accept key escrow. > ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps Ross Anderson has analyzed Mitchell's scheme, drawing the conclusion that "The GCHQ protocal is very poorly engineered." See ftp://ftp.cl.cam.ac.uk/users/rja14/euroclipper.ps.Z > I'm informed that this is likely to be introduced into EC legislation, though > my understanding is that members are not required to actually incorporate the > legislation. No doubt France will embrace it with happy shouts. The final decision will almost certainly with the member states, because cryptography is considered essential for national security.

1 0

(Fwd) Euro Key Escrow
by Peter Trei 17 Dec '03

17 Dec '03

>From the SSL-TALK mailing list. ------- Forwarded Message Follows ------- Subject: Euro Key Escrow To: cypherpunks(a)toad.com, ssl-talk(a)netscape.com, ssl-users(a)mincom.com, ietf-pkix(a)tandem.com Date: Thu, 7 Nov 1996 09:21:55 +0000 (GMT) From: Ben Laurie <ben(a)gonzo.ben.algroup.co.uk> Cc: ben(a)gonzo.ben.algroup.co.uk Reply-to: ben(a)algroup.co.uk Someone, somewhere, posted a rumour that Europe was about to go for a key escrow scheme known as "Royal Holloway". I have done a little research and gleaned the following: It is, apparently, true that the EC is considering schemes for key escrow, by "trusted third parties" (trusted by who, I'd like to know?). "Royal Holloway" is one of these schemes. It is named after the college of origin, if anyone cares. It essentially revolves around each pair of TTPs sharing two out of three parts of a key, and generating the third part for each of their users. The idea is that either of the TTPs who generated keys for an encrypted message exchange can decode it (by using the private key of their "client" and the public key of the other TTP's "client"). Full details can be found at: ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps This is in PostScript. I'm not aware of any plain text versions. I'm informed that this is likely to be introduced into EC legislation, though my understanding is that members are not required to actually incorporate the legislation. No doubt France will embrace it with happy shouts. Of course, it is our duty as netizens to resist this kind of rubbish, and I encourage you to write to your MP/EuroMP (or local equivalent). Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

1 0

Re: Is there a Win PGP?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben Laurie wrote: > > I did a port of PGP to a Windows DLL a long time back, but I never got > around to releasing it. I could bring it up to date and put it out > there if there is popular demand. I think that would be cool, especially given the growth in Windoze web servers and the halting start of PGP authentication for the web. Another WinPGP, of a sort, designed for email only, is FTP OnNet. You can get a demo from http://www.ftp.com/cgi/newmail.cgi They still haven't put any real export controls in place. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMoI/9yoZzwIn1bdtAQGG+wGAsSx6NcpJHxOgI1bwa52M2Fogd29C4XmO iMr/eoKCWRj+vIHjbLhNsPT966WmgiWT =SKCU -----END PGP SIGNATURE-----

1 0