December 2003 - cypherpunks-legacy

PGP automation
by holland＠CS.ColoState.EDU 17 Dec '03

17 Dec '03

Right now, it is a complete pain in the ass for me to encrypt or sign messages using PGP. The reason is because I have my email account on one of CSU's unix machines, so I have to do my posting there, while my PGP stuff lives on my PC in my apartment. Usually, I check my mail and read news by calling CSUNet over my modem, but if I want to encrypt, decrypt, sign or check the signature of a message, I have to zmodem the message to my machine, log off, decrypt or check the message while offline (or at least shelled into DOS), type up a reply, manually encrypt it and finally get back into my term program and zmodem the reply back up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since I don't trust their machines like I trust mine, but I am thinking about doing that and generating a key which I would be wiling to use for less secure stuff. Anyone here have any other suggestions on making encryption less of a pain? Doug | Doug Holland | Proud member of: | holland(a)beethoven.cs.colostate.edu | Mathematicians Against Drunk Deriving | Finger for PGP 2.2 key |

4 4

PGP automation
by Graham Toal 17 Dec '03

17 Dec '03

In article <9310281940.AA28085@beethoven> holland(a)cs.colostate.edu writes: > Right now, it is a complete pain in the ass for me to encrypt or sign > messages using PGP. The reason is because I have my email account on > one of CSU's unix machines, so I have to do my posting there, while > my PGP stuff lives on my PC in my apartment. Usually, I check my mail > and read news by calling CSUNet over my modem, but if I want to encrypt, > decrypt, sign or check the signature of a message, I have to zmodem the > message to my machine, log off, decrypt or check the message while > offline (or at least shelled into DOS), type up a reply, manually encrypt > it and finally get back into my term program and zmodem the reply back > up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since > I don't trust their machines like I trust mine, but I am thinking about > doing that and generating a key which I would be wiling to use for less > secure stuff. Anyone here have any other suggestions on making encryption > less of a pain? This may seem a little excessive, but the only sensible way to use pgp in environments like yours or prz's (heh heh) is to set yourself up with your own site at home, either with a dialup SLIP/PPP feed or a plain and cheap uucp feed. Both of those options are becoming much cheaper than they used to be, and you can run suitable software on all sorts of computers - whatever you're using to dial in to your timeshare service at the moment would probably do, as long as its not just a dumb terminal. DOS, a free unix or linux, Amiga, Atari - they can all handle at least uucp if not tcp/ip too. If you don't have suitable hardware, you can surelu find a 286 dos box with an old 20Mb drive and plain text- only display secondhand somewhere for $200 or less... that'll run UUPC or even KA9Q. If you care about privacy in your email, you *have* to run it all the way into your own machine. G

1 0

ON THE ROAD TO NOSINESS? THE SAME GEAR THAT WOULD SMOOTH OUT TRAFFIC JAMS
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My understanding is that IVHS systems are voluntary. Here are some examples of systems that invade your privacy, and yet are considered acceptable: - phone bill an itemized list of every number you called. - credit card bill Where and how much you spent - school records - criminal record All this information is easily obtainable. Do you think that people will reject a system that saves them a significant portion of their trip to work each day so that there is no record of where they drove? Also, I believe most toll collection systems being built are on a pre-paid basis, and anonymity is retained unless there is a violation. In that case, a photograph is taken of the plate. In Europe, I believe that there are highways that you can speed on, and then receive a ticket in the mail when the camera photographs your plate. Okay, that's the devil's advocate point of view. The argument of the IVHS proponents. Personally, I believe that IVHS is receiving enough government funding that it will happen. Nothing is inevitable, but money talks. To combat the privacy-invading aspects of IVHS will take a substancial political battle. Isn't Clinton's proposed Health card a bigger threat than IVHS? I believe we should concentrate on privacy issues as they relate to computer systems and cryptography. We are cypherpunks, not just punks. Those issues are also important, but probably more related to alt.privacy or some such group. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNGBlR1kTJuroDD9AQEXwwIAlu3Nq9XAxN5z6GgSETxa1/yhL/UI0dIf CcLietZRDnknSz4m9j8WcgGqezmkzCoWUx4mSz634mdo7BNIJ+TC6Q== =ivnS -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Nazis/Privacy/Cypherpunks
by Dark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -> Observe the following exchange > I remember reading some time ago that the Nazis had a method of >trapping communists that went like this: > They'd put the suspect in room and carry on a conversation with him >(all males, as I remember). [Stuff deleted, no value judgment implied.] This practice is, IMHO, extremely unethical and dubious at best! If the world's experiences are a metaphorical "object" bundled up in a <.lib> somewhere in the cosmos, then *anything* that the Nazi's did should be considered completely bugged code. Why do we want to inherit their flawed algorithm's? [See note 1] The whole point of the cypherpunk cause is to compile code from the ground up--considering the ethics involved with decisions such as rooting out 'nyms. [See note 2] Have we decided that it is now imperative to know the identities of those on 'our' side (further fueling this polarization of 'us' versus 'them')? Let's leave behind this obsession with determining who's who; it has taken us too close to the kluged code of Nazi history! My eye is on the prize... ;) [See note 3] --- still(a)kailua.colorado.edu ------------------------------------ - -> so... [Note 1] Personally, I don't rule out examination of Nazi tactics as a worst case scenario model. Let's face it, as ugly and dark as Nazi rule was, they did some things quite efficiently indeed. Take state security. The Nazi's had so perfected the process of identifying dissidents and quashing opposition that aside from the high ranking traitors, war time and early pre-war Nazi Germany was probably the most stable dictatorship in history. (From an internal and counter intelligence perspective anyhow [See Barry Posen for more.]) The price, of course, was the death of many, many innocents who were just perceived as threats (camps aside.) To rule out Nazi approaches, especially when dealing with intelligence and counter-intelligence issues (which IMHO is basically what cypherpunks is all about on some level or another...) is plain silly. Current intelligence practices are based a great deal on what was learned in WWII (OSS being the basis for today's CIA etc...) I'll begin to differ when you start talking about medical issues. [Note 2] No one writes code from "the bottom up" in the manner that you suggest. If that were the case we'd see the wheel invented time and time again. One of the reasons this mailing list exists is to accomplish exactly the opposite. That being to incorporate common or even fringe ideas into the development of code for the common purpose (The Prize as you adeptly put it.) so we don't HAVE to build from the ground up every time. [Note 3] One of the ways we learn is through trial and error amongst ourselves. It's funny that the list is beginning to lose some of the major personas that were here when I first joined last fall (winter?) Cypherpunks was a collection of experts, and newbies all feeding off each other to push the technologies farther and make a social impact encouraging privacy in the process. Where better to defeat anonymous posting and improve the art than among ourselves? This brings up a side issue for me, and incidentally the reason I rejoined cypherpunks (aside from my brief loss of net access when I went back to Liechtenstein this summer). More and more, where I look, I see privacy in this country eroded. It has gotten to the point where I can see no other direction now than the centralization of government in an age where technology makes it a joke to keep track of individuals from what they buy, to which toll booths they drive through, to which bank tellers they use, to what they "Publish" on the net. I feel that a hands on approach for government becomes more and more dangerous the farther technology progresses. Information technology is like nuclear technology in this way, you just can't tell how it will be applied, to liberate, or to oppress. Either is possible. Will something not have to give if we are to be reasonably secure in the belief that a brutal and powerful dictatorship will not succeed in this country? I will be the first to admit that the U.S. is not likely to fall to such a fate in the next (insert number appropriate to your ideology here) years, but if it does, it will be a dictatorship/authoritarian/ centralized power the likes of which no one has ever seen. The tools exist to make freedom meaningless. Personally I'm not secure enough relying on the balance of powers as the only safeguard. The omnipotence that any authoritarian power would have in this country, a country where the pizza delivery man punches up your usual order and doesn't have to ask for your address or credit card number when you call (In 2 years will they have to answer the phone at all?), is staggering in its scope. If the Nazi's took power in such an environment... phew. Personally (yet again) with the prospect of national health care, the card to be issued at birth, and the adjoining files to be collected on anyone who claims anything under it, I am that much more sure that everyone should establish three or four identities complete with documentation before acquiring such documentation becomes impossible anymore. (Speaking of which, does anyone know if the Social Security act of 1974 which limited the use of Social Security numbers and tried to form some basic (albeit limited) privacy to card holders has any counterpart in the health card?) There is great safety in anonymity. I intend to keep it. - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNGb1xibHbaiMfO5AQH2QgP+KkvBHohXgFMEhotPPSwFgqWta5E+KTuk tfSSFLO0EyoERFUz6mZPU6cKFpxAgpX5aHNeHsfAwLs0WRQs+T4ZE7cJDgDS215F gmhUaHKpBfgwQz5aoT1EHnGcLRZCQl9h2uAXubpnHUUb1d+sBWUNRnFJKkKmBIZ+ eODsv0JZHEc= =yXrJ -----END PGP SIGNATURE-----

1 0

ViaCrypt PGP on its way
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I ordered ViaCrypt PGP today. They said I should get it by next friday. I'll post comments about it as I learn to use it. I haven't used "classic" PGP so I wont be able to make any commparisons. Jim_Miller(a)suite.com (camping on the mailbox)

1 0

Re: ID of anonymous posters via word analysis?
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't see anything wrong or unethical about using software. It is true that the Nazis used gas against the Jews in WW II, so are you not going to use gas? I hope this doesn't sound insensitive, but part of studying anonymity and the pseudonymous experience is finding out what sort of techniques can be used to discover someone's nym. I pointed one out earlier - watching for double postings, one by nym, the other by actual identity. If studying writing patterns is a viable method for discovering the true identity of a nym, then by all means try it. If someone were to discover my identity, I would use it as a learning experience. I'm going to be as careful as possible, but I would not advocate ignoring software if it exists, no matter what its historical significance. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNF+hh1kTJuroDD9AQG96QIAo5JEYTSOAwaAdFDs9AOEbbq27Uho3b8r T1corhWKdZVmESMYLKTCaIcxlkABUcCcZfyCS8bLlud7P4HlCSq3dw== =RKfn -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

ID of anonymous posters via word analysis?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <Pine.3.87.9310291032.A24998-0100000(a)crl.crl.com> arthurc(a)crl.crl.com writes: > I think that identification by buzzwords, habitual misspellings, etc. > could be used to identify anonymous posters. Sentence structure is also > revealing. Le style, c'est l'homme, said Voltaire. Of course, it all > comes down to how much time and effort you want to put into proving, say, > that SBoxx=LDetweiler. I had a go at this just for fun when an8785 was doing his thing. I'm pretty sure I identified him correctly in the end. (The guy I thought it was, when I asked him, said 'If I were I wouldn't tell you', whereas all the other people I suspected but not as strongly all denied it violently, heh heh heh) I think this sort of analysis could be automated to a reasonable extent, to cut out the TypeI errors that the guys who did Shakespeare/Bacon analysis made. It's very easy to fool yourself if you don't have predefined criteria of comparison and a rigid marking scheme. I'm fairly sure that a sufficiently detailed analysis looking at enough different points of style would still catch someone's fingerprint even if they went out of their way to disguise their postings. The only approach I can think of that would be successful in hiding individual style is for person A to write something, person B reads it quickly, then attempts to write something with the same semantic content, but of course it will have B's grammar and phraseology and punctuation idiosyncracies. (And this only works if B is not a net poster, otherwise you recognise B and work out who his friends are :-) ) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

3 2

Re: pgp and procmail
by J. Michael Diehl 17 Dec '03

17 Dec '03

Well, I've had a lot of people asking me where to get procmail from. I'm including several addreses at the end of this list. At the momeent, I am testing my procmail recipes for pgp. I suspect I have a file locking problem, which, while it hasn't manifested itself yet, could cause problems later. I am working on fixing this before I release my recipes. So that I may test my recipes, I would appreciate it if you would send me, first, a copy of your public key, then a message signed with it. Also, I would like you to try to spoof it. To make this easier for you, I will send you back your message as it appears in my mailbox. Thanx in advance. Host ftp.cs.widener.edu (147.31.254.132) Location: /pub/src/mail FILE -r--rw-r-- 118657 bytes 00:00 1 Jul 1992 procmail.tar.Z Host ftp.sunet.se (130.238.127.3) Location: /pub/unix/mail FILE -rw-rw-r-- 111459 bytes 22:00 15 May 1992 procmail.tar.Z Host ftp.edvz.univie.ac.at (131.130.1.4) Location: /unix/systems/linux/util/mail FILE -rw-r--r-- 221413 bytes 02:08 25 Jun 1993 procmail.tar.Z Host alf.uib.no (129.177.30.3) Location: /pub/Linux/util/mail FILE -rwxr-xr-x 221413 bytes 03:18 26 Jun 1993 procmail.tar.Z Host keos.helsinki.fi (128.214.4.83) Location: /pub/archives/comp.sources.misc DIRECTORY drwxrwxr-x 512 bytes 00:00 12 Feb 1993 procmail

1 0

Duplicate key in keyring?
by J. Michael Diehl 17 Dec '03

17 Dec '03

Lately, when I use pgp -ka, I get the following message: warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' I'm using the keyring from the key-server. This really annoys me. Is there any way to fix this? Thanx in advance. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

2 1

Sternlight with the news...
by Anonymous 17 Dec '03

17 Dec '03

Newsgroups: sci.crypt,talk.politics.crypto,alt.security.pgp,alt.security.ripem,comp.org.eff.talk From: strnlght(a)netcom.com (David Sternlight) Subject: News from the cipher front Message-ID: <strnlghtCFKJoH.IHu(a)netcom.com> Organization: DSI/USCRPAC Date: Wed, 27 Oct 1993 18:36:16 GMT Lines: 143 Ciphertext, the RSA newsletter (v1 n1, Fall 1993) showed up in my mailbox this week. It contains much useful and interesting information, as well as an announcement of RSA's 1994 conference on January 12-14. What follows are some digested excerpts, posted with permission. On the Clipper front there is a very useful and non-polemical summary of the technical aspects of Clipper by Paul Fahn, and an article by Martin Hellman. Hellman is a Distinguished Associate of RSA Laboratories, one of the inventors of Public Key technology, and a Professor of Electrical Engineering at Stanford. He's not happy with Clipper as presently proposed, and says why. Since the article is based on his NIST testimony, the latter can be obtained by anonymous ftp at isl.stanford.edu in /pubs/hellman/nist.clipper.text. The third annual RSA Data Security Conference is at Redwood Shores, CA. It costs $245 per person. There is no Onsite registration. Deadline is Friday 12/17/93. For details contact RSA. Registration is limited to 400 and includes the conference, tutorials, and hardcopy conference proceedings, as well as a cocktail reception, and breakfast and lunch on all three days. Apple Ships RSA Digital Signature in Long-Awaited System 7 Pro. On October 4th, Apple Computer introduced millions of new users to the RSA Digital Signature. The producs are called PowerTalk and PowerShare and are part of System 7 Pro, a new version of the Mac operating system. They include five components, integrated into the operating system--Messaging, Electronic Mail Directories, Privacy and Authentication, and Digital Signatures. They also include RSA's RC4 symmetric stream cipher for server-to-server link encryption. Powertalk is compliant with the Public Key Cryptography Standards, and users will receive a voucher for a free unaffiliated "residential digital certificate, good for use with any secure PKCS or Internet PEM-compliant application. The Apple System 7 Pro implementation is PEM-certificate compatible, and the messages are as well. (For those who want privacy, RIPEM Mac operates with the key pair generated by the Mac.) There is an API to the sign/verify functions of the MacOS so that any app developer can use the features without needing to license from RSA. Of course, the MacOS with RSA Digital Signatures is fully exportable. RSA has a free signer utility for Windows that is compatible with the Mac sigs. Internet Privacy Enhanced Mail Arrives. Several commercial and freeware versions are available right now: TechMail, written at MIT, is a complete mail reading program for Macintosh and (soon) Windows. It includes full implementation of the Internet PEM RFCs, using RSA's TIPEM toolkit as its security engine. It is a client of the Internet Post Office Protocol. Techmail for the Mac is available from net.dist.mit.edu in pub/TechMail. It runs on SLIP or non-SLIP. (Poster's note: The SLIP version incudes PEM and works fine. I haven't tested the non-slip version and am not sure if it yet includes PEM.) TIS/PEM and T-Mail are non-commercial freeware and commercial supported versions, respectively, of Trusted Information Systems implementations of Internet PEM. The former was developed under contract with ARPA and agreement with RSADSI and is available in source code for academic research or exploratory use by corportions or individuals on the Internet. For more information send e-mail to tispem-support(a)tis.com. TIPEM 1.1 is the latest release of RSA's Toolkit for Interoperable Privacy-Enhanced Messaging. It permits creating applications that comply with the Internet PEM standards as well as the commercial Public Key Cryptography Standards (PKCS) established by vendors including Lotus, Apple, Novell, and Microsoft. The toolkit was used for Apple's Powertalk. It is available directly from RSA Data Security Inc. RIPEM is another freeware public key encryption program designed for Internet PEM. It implements a subset of PEM as described in RFC's 1421-1424 The internet host ripem.msu.edu acts as a RIPEM key server for users who choose to register their keys. It is available via anonymous ftp from rsa.com and non-anonymous ftp from ripem.msu.edu. RSA Certificate Services Center Opens for Business. This article describes the center RSA has established to get ral certificates with your name, public key, and organizational affiliation safely embedded in a cryptographically tamper-proof digital document. This provides the digital ID for Apple Powertalk, Internet Privacy-Enhanced Mail, or any X.509 certificate-based secure application. The center allows you to issue your own affiliated certificates using RSA's Certificate Issuing System; or the Certificate Services Center can issue affiliated certificates for you, or you can purchase individual unaffiliated certificates directly from the CSC. Revocation services are also provided, as are certificate verification services. Users of Apple's System 7 PRO may get their first certificate free. (Poster's note--as I understand it, subsequent individual certificates are $25.) For more information contact George Parsons, CSC Manager at 415-595-8782. RSA Licensee Update: This piece is a partial list of products using RSA Technology available now or coming soon. They include products from Novell, Apple, Microsoft, Trusted Information Systems, Motorola, AT&T, Lotus, Word Perfect, Racal, IBM, Northern Telecom, Hughes, etc. in categories of Security in the OS, Secure E-mail, Secure Telephone and Fax, Secure Workgroup, Secure Electronic Forms, Link and Node Encryption, and Secure Remote Access. Hilgraeve Licenses RSA for Best-Selling Asynch Package. Hilgraeve, Inc. is about to release the very first mass-market asynchronous communications package with RSA encryptoin capabilities built in. The current release of that software, HyperACCESS/5 is already a market leader, for DOS, OS/2, and Windows. It has received PC Magazine's Editors' Choice Award three out of the past five years for its quality, performance, and ease of use. For more information, contact Matt Gray at 313/243-0576. DataMedia's SECURExchange can "secure virtually any existing DOS, Windows, or Macintosh E-mail system. It uses RSA Digital Envelopes, RSA Digital Signatures, and RSA Digital Certificates. It has been fully tested with cc:Mail, Microsoft Mail, DaVinci Mail, Beyond Mail, Internet, Compuserve, MCI Mail, AT&T EasyLink, and other systems. For more info call 603/886-1570. Dr. Ron Rivest has a piece on the Difficulty of Factoring--a reprint of a "classic paper." The RSA Factoring Challenge is a list of very long numbers posted on rsa.com. There are cash prizes for the most successful factorers. Prizes vary from the tens to the thousands of dollars, and unrewarded prize money rolls over into a kitty from month to month. SmartDisk is a smartcard that fits in a standard 3-1/2 inch diskette slot and interfaces with the disk read heads. It's a high-performace smart card that doesn't need a reader. It has its own embedded OS firmware. the firt application available is SafeBoot, a complete PC access control package which is "virtually unhackable. The encryption algorithm and key are stored on the SmartDisk to protect them. For further info call Gene Wagner or Jon Kaplan at Fischer International, 813/643-1500. The above excerpts are only partial summaries of the material in the newsletter. RSA Data Security Inc. is at 100 Marine Parkway, Suite 500, Redwood City, CA 94065-1031. Disclaimer: The poster of this summary has no connection with any of the companies mentioned herein, except as an occasional beta tester for some, and an interested observer. David -- David Sternlight When the mouse laughs at the cat, there is a hole nearby.--Nigerian Proverb

1 0