December 2003 - cypherpunks-legacy

signing messages
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

How does one sign a message w/ PGP when one doesn't have the public key of a recipient? Example: when a key is signed to authenticate it, or when the source code for PGP is signed to authenticate it. Forgive me if this is a stupid question. -john.

1 0

Re: ID of anonymous posters via word analysis?
by jon＠balder.us.dell.com 17 Dec '03

17 Dec '03

People interested in fingerprinting anonymous posters might be interested in a Markov tuple analysis program that was posted to the net eons ago. It should be in the '85 or '86 comp.sources under the name markov3. I recall that this was a program that fed enough posts from a given poster would create another post in their "style"; it was kinda fun. Jon -- ,,, (o o) Jon Boede ----ooO-(_)-Ooo---- jon(a)dell.com +1 512 728-4802 Engineering, Dell Computer Corp. Server OS Development Austin, TX "The problem is that _they_ see us as *them*." -- John Gilmore, Cypherpunk

3 2

Re: ID of anonymous posters via word analysis?
by James Still 17 Dec '03

17 Dec '03

> I remember reading some time ago that the Nazis had a method of >trapping communists that went like this: > They'd put the suspect in room and carry on a conversation with him >(all males, as I remember). Then, after several hours of conversation >about any and all kinds of subjects, they would tote up the number of >times that the suspect used the word "concrete" -- evidently a favorite >left-wing buzzword in the '30s. If the "concrete" cropped up frequently >.... off to camp went the suspect. This practice is, IMHO, extremely unethical and dubious at best! If the world's experiences are a metaphorical "object" bundled up in a <.lib> somewhere in the cosmos, then *anything* that the Nazi's did should be considered completely bugged code. Why do we want to inherit their flawed algorithm's? The whole point of the cypherpunk cause is to compile code from the ground up--considering the ethics involved with decisions such as rooting out 'nyms. Have we decided that it is now imperative to know the identities of those on 'our' side (further fueling this polarization of 'us' versus 'them')? Let's leave behind this obsession with determining who's who; it has taken us too close to the kluged code of Nazi history! My eye is on the prize... ;) --- still(a)kailua.colorado.edu ------------------------------------

1 0

My PGP pubkey has been changed...
by hiscdcj＠lux.latrobe.edu.au 17 Dec '03

17 Dec '03

Hi, I've changed my public key. Anyone who has a copy of my old one and needs to use it, I can still decrypt stuff using that, but my fingerable public key, and the one in the keypair I will be encrypting stuff with, has changed. So there. Dwayne. (Dwayne Jones-Evans IRC: ddraig ) ( SCA: Cynon Yscolan ap Myrddin, Stormhold, Lochac, West) PGP public key available. finger me. be gentle. internet---> hiscdcj(a)lux.latrobe.edu.au

1 0

Re: signing messages
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> How does one sign a message w/ PGP when one doesn't have the public key of a > recipient? Example: when a key is signed to authenticate it, or when the > source code for PGP is signed to authenticate it. > > Forgive me if this is a stupid question. > -john. There are no recipients necessarily involved. A signature with your secret key is proof that the message (or file) came from you. Anyone with your public key can confirm its authenticity. If you want to sign someone's public key, you obviously need their key, but otherwise, signing something involves only you and no one else. (Many people's public keys are on the public key servers, so that's a good place to look if you need to find someone's key. See the document <keyserv.doc> in the PGP package for more information about the servers.) If you want to sign a message intended for one person only, you sign it and then encrypt with their public key. --Dave.

1 0

PGP automation
by Graham Toal 17 Dec '03

17 Dec '03

In article <9310281940.AA28085@beethoven> holland(a)cs.colostate.edu writes: > Right now, it is a complete pain in the ass for me to encrypt or sign > messages using PGP. The reason is because I have my email account on > one of CSU's unix machines, so I have to do my posting there, while > my PGP stuff lives on my PC in my apartment. Usually, I check my mail > and read news by calling CSUNet over my modem, but if I want to encrypt, > decrypt, sign or check the signature of a message, I have to zmodem the > message to my machine, log off, decrypt or check the message while > offline (or at least shelled into DOS), type up a reply, manually encrypt > it and finally get back into my term program and zmodem the reply back > up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since > I don't trust their machines like I trust mine, but I am thinking about > doing that and generating a key which I would be wiling to use for less > secure stuff. Anyone here have any other suggestions on making encryption > less of a pain? This may seem a little excessive, but the only sensible way to use pgp in environments like yours or prz's (heh heh) is to set yourself up with your own site at home, either with a dialup SLIP/PPP feed or a plain and cheap uucp feed. Both of those options are becoming much cheaper than they used to be, and you can run suitable software on all sorts of computers - whatever you're using to dial in to your timeshare service at the moment would probably do, as long as its not just a dumb terminal. DOS, a free unix or linux, Amiga, Atari - they can all handle at least uucp if not tcp/ip too. If you don't have suitable hardware, you can surelu find a 286 dos box with an old 20Mb drive and plain text- only display secondhand somewhere for $200 or less... that'll run UUPC or even KA9Q. If you care about privacy in your email, you *have* to run it all the way into your own machine. G

1 0

ON THE ROAD TO NOSINESS? THE SAME GEAR THAT WOULD SMOOTH OUT TRAFFIC JAMS
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My understanding is that IVHS systems are voluntary. Here are some examples of systems that invade your privacy, and yet are considered acceptable: - phone bill an itemized list of every number you called. - credit card bill Where and how much you spent - school records - criminal record All this information is easily obtainable. Do you think that people will reject a system that saves them a significant portion of their trip to work each day so that there is no record of where they drove? Also, I believe most toll collection systems being built are on a pre-paid basis, and anonymity is retained unless there is a violation. In that case, a photograph is taken of the plate. In Europe, I believe that there are highways that you can speed on, and then receive a ticket in the mail when the camera photographs your plate. Okay, that's the devil's advocate point of view. The argument of the IVHS proponents. Personally, I believe that IVHS is receiving enough government funding that it will happen. Nothing is inevitable, but money talks. To combat the privacy-invading aspects of IVHS will take a substancial political battle. Isn't Clinton's proposed Health card a bigger threat than IVHS? I believe we should concentrate on privacy issues as they relate to computer systems and cryptography. We are cypherpunks, not just punks. Those issues are also important, but probably more related to alt.privacy or some such group. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNGBlR1kTJuroDD9AQEXwwIAlu3Nq9XAxN5z6GgSETxa1/yhL/UI0dIf CcLietZRDnknSz4m9j8WcgGqezmkzCoWUx4mSz634mdo7BNIJ+TC6Q== =ivnS -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Nazis/Privacy/Cypherpunks
by Dark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -> Observe the following exchange > I remember reading some time ago that the Nazis had a method of >trapping communists that went like this: > They'd put the suspect in room and carry on a conversation with him >(all males, as I remember). [Stuff deleted, no value judgment implied.] This practice is, IMHO, extremely unethical and dubious at best! If the world's experiences are a metaphorical "object" bundled up in a <.lib> somewhere in the cosmos, then *anything* that the Nazi's did should be considered completely bugged code. Why do we want to inherit their flawed algorithm's? [See note 1] The whole point of the cypherpunk cause is to compile code from the ground up--considering the ethics involved with decisions such as rooting out 'nyms. [See note 2] Have we decided that it is now imperative to know the identities of those on 'our' side (further fueling this polarization of 'us' versus 'them')? Let's leave behind this obsession with determining who's who; it has taken us too close to the kluged code of Nazi history! My eye is on the prize... ;) [See note 3] --- still(a)kailua.colorado.edu ------------------------------------ - -> so... [Note 1] Personally, I don't rule out examination of Nazi tactics as a worst case scenario model. Let's face it, as ugly and dark as Nazi rule was, they did some things quite efficiently indeed. Take state security. The Nazi's had so perfected the process of identifying dissidents and quashing opposition that aside from the high ranking traitors, war time and early pre-war Nazi Germany was probably the most stable dictatorship in history. (From an internal and counter intelligence perspective anyhow [See Barry Posen for more.]) The price, of course, was the death of many, many innocents who were just perceived as threats (camps aside.) To rule out Nazi approaches, especially when dealing with intelligence and counter-intelligence issues (which IMHO is basically what cypherpunks is all about on some level or another...) is plain silly. Current intelligence practices are based a great deal on what was learned in WWII (OSS being the basis for today's CIA etc...) I'll begin to differ when you start talking about medical issues. [Note 2] No one writes code from "the bottom up" in the manner that you suggest. If that were the case we'd see the wheel invented time and time again. One of the reasons this mailing list exists is to accomplish exactly the opposite. That being to incorporate common or even fringe ideas into the development of code for the common purpose (The Prize as you adeptly put it.) so we don't HAVE to build from the ground up every time. [Note 3] One of the ways we learn is through trial and error amongst ourselves. It's funny that the list is beginning to lose some of the major personas that were here when I first joined last fall (winter?) Cypherpunks was a collection of experts, and newbies all feeding off each other to push the technologies farther and make a social impact encouraging privacy in the process. Where better to defeat anonymous posting and improve the art than among ourselves? This brings up a side issue for me, and incidentally the reason I rejoined cypherpunks (aside from my brief loss of net access when I went back to Liechtenstein this summer). More and more, where I look, I see privacy in this country eroded. It has gotten to the point where I can see no other direction now than the centralization of government in an age where technology makes it a joke to keep track of individuals from what they buy, to which toll booths they drive through, to which bank tellers they use, to what they "Publish" on the net. I feel that a hands on approach for government becomes more and more dangerous the farther technology progresses. Information technology is like nuclear technology in this way, you just can't tell how it will be applied, to liberate, or to oppress. Either is possible. Will something not have to give if we are to be reasonably secure in the belief that a brutal and powerful dictatorship will not succeed in this country? I will be the first to admit that the U.S. is not likely to fall to such a fate in the next (insert number appropriate to your ideology here) years, but if it does, it will be a dictatorship/authoritarian/ centralized power the likes of which no one has ever seen. The tools exist to make freedom meaningless. Personally I'm not secure enough relying on the balance of powers as the only safeguard. The omnipotence that any authoritarian power would have in this country, a country where the pizza delivery man punches up your usual order and doesn't have to ask for your address or credit card number when you call (In 2 years will they have to answer the phone at all?), is staggering in its scope. If the Nazi's took power in such an environment... phew. Personally (yet again) with the prospect of national health care, the card to be issued at birth, and the adjoining files to be collected on anyone who claims anything under it, I am that much more sure that everyone should establish three or four identities complete with documentation before acquiring such documentation becomes impossible anymore. (Speaking of which, does anyone know if the Social Security act of 1974 which limited the use of Social Security numbers and tried to form some basic (albeit limited) privacy to card holders has any counterpart in the health card?) There is great safety in anonymity. I intend to keep it. - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNGb1xibHbaiMfO5AQH2QgP+KkvBHohXgFMEhotPPSwFgqWta5E+KTuk tfSSFLO0EyoERFUz6mZPU6cKFpxAgpX5aHNeHsfAwLs0WRQs+T4ZE7cJDgDS215F gmhUaHKpBfgwQz5aoT1EHnGcLRZCQl9h2uAXubpnHUUb1d+sBWUNRnFJKkKmBIZ+ eODsv0JZHEc= =yXrJ -----END PGP SIGNATURE-----

1 0

ViaCrypt PGP on its way
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I ordered ViaCrypt PGP today. They said I should get it by next friday. I'll post comments about it as I learn to use it. I haven't used "classic" PGP so I wont be able to make any commparisons. Jim_Miller(a)suite.com (camping on the mailbox)

1 0

Re: ID of anonymous posters via word analysis?
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't see anything wrong or unethical about using software. It is true that the Nazis used gas against the Jews in WW II, so are you not going to use gas? I hope this doesn't sound insensitive, but part of studying anonymity and the pseudonymous experience is finding out what sort of techniques can be used to discover someone's nym. I pointed one out earlier - watching for double postings, one by nym, the other by actual identity. If studying writing patterns is a viable method for discovering the true identity of a nym, then by all means try it. If someone were to discover my identity, I would use it as a learning experience. I'm going to be as careful as possible, but I would not advocate ignoring software if it exists, no matter what its historical significance. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNF+hh1kTJuroDD9AQG96QIAo5JEYTSOAwaAdFDs9AOEbbq27Uho3b8r T1corhWKdZVmESMYLKTCaIcxlkABUcCcZfyCS8bLlud7P4HlCSq3dw== =RKfn -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0