December 2003 - cypherpunks-legacy

Thanks
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

1 0

PGP 2.6 ???
by dat＠ebt.com 17 Dec '03

17 Dec '03

What's the story with PGP 2.6? I haven't (yet) gotten any hard information about it -- is there mail I should have gotten but didn't? I'm sure glad MIT put out 2.5, before putting out 2.6. It would have been much worse if they went right to 2.6. It does seem fortuitous that 2.5 ever got released at all, or am I missing something? This whole process backs up the point that the whole cryptography infrastructure is important. Maybe the world will split into 2.6+ and 2.5- camps, with the 2.6+ camps being locked onto a bandwagon they can't get off of. Maybe all software in the future will have 2.6+ built into it, making life really unmanagable for the dwindling 2.5- crowd[sic]. How can you get cryptography to the masses when they all have Clipper? You can't -- if it gets that bad, we've lost the battle (although we can keep our own antique 2.5- copy if we want to, as a relic from the "good old days"). I'd bet that 2.6 doesn't have a backdoor in it, but that 2.7 or 2.8 or 3.9 or 123.456 eventually will... And, as I pointed out before, if the world gets saddled with a key length restriction in whatever evolves to become the standard, eventually that will be equivalent to a back door. Maybe I'm too pessimistic, but how can we fight the infrastructure battle? I'm sore afraid that our brand of crypto is like trying to peddle a new OS to compete with Unix/NT/... -- it just ain't real easy to displace a "standard", flawed though it may be... Any ideas are welcome -- I'm just running a little low now. -- dat(a)ebt.com (David Taffs)

2 1

Re: pgp 2.6 stupidity
by Blanc Weber 17 Dec '03

17 Dec '03

From: Paul Ferguson Personally, I can't see any compelling reason, save legality, for domestic or international users of PGP to upgrade beyond 2.3a. ........................................... Who/how would anyone know which version is being used? Are there going to be net police checking this out? Blanc

1 0

[ANON] War in rec.guns
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

[[Reply-To: john.nieder(a)tigerteam.org]] * Original msg to: Thomteach(a)aol.com -=> Quoting Thomteach(a)aol.com to John Nieder <=- Th> Frankly, if anyone should be discreet, I wish it would be the folks Th> who use my personal E-mail address. Getting exposed to the message Th> involuntarily is something of a drag. At least when such messages are Th> posted to the rec.guns address, I am left with the _choice_ of whether Th> or not to access the post. Alas, Tom, this is untrue. My posts to rec.guns are being stopped by the moderator, as are at least some of the other pro-anon messages going to the group. I put a Bcc: list up including you and others who had commented on the [ANON] thread there or to me by netmail so you would have an unfiltered source for my posts in the continuing discussion. You may get two more posts from a mailing I already sent out tonight, but in that you are apparently requesting that you receive no more netmail on this I will delete your name. Any others receiving these posts netmail who do not wish to, please let me know and I will delete them from the Bcc: list, with my apologies. If indeed the moderator was following his philosophy of - what was it? - "sunlight" or "openness," in the newsgroup instead of selective suppression of dissenting messages, these mailings would have been unnecessary. Thanks for your patience. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|

1 0

pgp 2.6 stupidity
by perry＠imsi.com 17 Dec '03

17 Dec '03

Personally, I find the PGP 2.6 announcement to be based on an extremely flawed premise. PGP 2.3a and earlier were not American software -- they were written and produced overseas and were IMPORTED into the U.S. They infringe on no patents or copyrights when used overseas. Well, I have lots of correspondants overseas, using perfectly legal software. They cannot legally use PGP 2.6 -- it isn't exportable. Therefore, this idiocy will act to cut me off from my overseas correspondants. I will not be able to use the current version of PGP and still communicate with them. I will therefore be forced to use older versions -- probably repeatedly patched versions of 2.5. Perry

4 3

Hmm
by Robert A. Hayden 17 Dec '03

17 Dec '03

Hmm, since I brought up the idea, can I take a flat 10% off the top of any winnings? Sorta a finders fee or someting? Robert "momma needs a new hard drive" Hayden -- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> Political Correctness is \/ Finger for PGP 2.3a Public Key <=> P.C. for "Thought Police" -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Barlow Liberty Essay Airs on PBS May 17
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: Date: Mon, 16 May 1994 10:34:42 -0800 From: John Perry Barlow <barlow(a)eff.org> Subject: Barlow Liberty Essay Airs on PBS Tomorrow Night Folks, I commend to your attention a video essay on Liberty which I did for PBS last summer. It will air tomorrow May 17 at 10:00 PM EST (your listings may vary) as part of a program called Declarations. Could I please persuade those of you who re-post to put this in any places where there might be people interested? Thanks much. Enduring, Barlow -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Fixing pgp 2.6
by Mike Ingle 17 Dec '03

17 Dec '03

>In order to fully protect RSADSI's intellectual property rights in >public-key technology, PGP 2.6 will be designed so that the messages it >creates after September 1, 1994 will be unreadable by earlier versions >of PGP that infringe patents licensed exclusively to Public Key Partners >by MIT and Stanford University. PGP 2.6 will continue to be able to read >messages generated by those earlier versions. So it will produce readable messages before Sept 1, 1994? Then there must be an if somewhere in the program to check the date. That should be fix- able with a patch of a few bytes to the object code. The best way to uncripple it would be to distribute a small .exe program which patches your version of PGP in place. Also include the source for the .exe so nobody thinks it does anything evil. We are being divided and conquered. If PGP 2.6 succeeds, our goal of a worldwide strong crypto standard is dead. This needs to be stopped. --- Mike

2 1

Re: Fixing pgp 2.6
by Hal 17 Dec '03

17 Dec '03

I think there are some things being overlooked in this discussion. First, note the strong hint in Schiller's message about operators of key servers who accept pre-2.6 keys being guilty of contributory infringement of the RSA patent. I think we can expect strong legal pressure from RSA to shut down the remaining U.S. key servers, even those which don't use illegal versions of PGP. They succeeded once in shutting down the key servers which used PGP; they will succeed again in shutting down the others due to the contributory infringement threat. For the same reason, hopes of getting a non-RSA-approved "2.6a" (hacked to be backwards compatible with 2.3) widely available in the U.S. are not well founded. FTP sites which hold programs or even patch files to allow 2.6 to interoperate with 2.3 will be targetted by RSA as contributory infringers. In short, the legal advantages PGP 2.6 will have over unapproved versions will be strong enough that it will be widely used in the U.S. However, this does not mean the loss of international encrypted communications. The solution is simple. PGP 2.3a will be patched to be compatible with PGP 2.6. I don't know what we'll call it, "PGP2.3e", perhaps, where "e" is for Europe. 2.3e will have the speed advantages of 2.3a, no copyright problems with RSAREF use, be perfectly legal outside the U.S., and will interoperate with 2.6. Converting from 2.3a to 2.3e will be no more difficult than converting from 2.2 to 2.3 was. Although I hate Jim Bidzos' guts for what he has done to Phil, he holds the legal upper hand for the next few years. The present course does allow for wider use of encryption by the public, which we can all support. Look at it rationally, and 2.6 is a step in the right direction. Hal P.S. It's possible that pre-2.6 keys will not interoperate with 2.6, in which case users of both 2.6 and what I am calling 2.3e will have to generate new keys. This is no great problem; people should make new keys and retire their old ones every year or two anyway, IMO.

2 1

Remailer low usage is not surprising
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

After a period of not using them much, I just tried several of the remailers listed in the various summaries by Karl Barrus and Xenon, and the ad hoc "foo is up again" sorts of messages. The results were disappointing. One remailer I used to use quite a bit no longer seems to be working at all, and others still haven't responded to my ping. Couple this with other problems: * one of the hacktic.nl remailers was announced (in a newsgroup) as going offline because the owner of the laptop (!) it ran on was going to Spain for a few months. * other remailers have gone up, down, and sideways...with little warning or "persistence." * the "finger" command that was supposed to at one point provide a fairly current summary, never worked for me. (Sorry, I can't find this finger report, but the idea was that one would "finger foo(a)bar.baz" and a recent ping of the existing remailers would be returned. I tried it several times, but the results were clearly wrong.) * I know about both Matthew Ghio's ping program and Xenon's SuperPing script, but these are both cumbersome to set up and use and will not exactly make remailer use widespread. * What I suspect many of us do is to find a remailer that works, that we get comfortable with, and then use that. This is OK for very low-grade, casual use, but only for that. And, as I just found out, when that system vanishes, changes, or otherwise no longer works.... Caveat: I'm not pointing fingers (literally), and I appreciate the work that has gone into remailers, and the not ignorable personal risk that remailer operators have incurred. And I am not volunteering others for more work. But it is certainly fair to comment on the implications of this state of affairs, right? * The ad hoc, "it'll be up if I remembered to plug in the modem" nature of _some_ remailers is not conducive to wide use, especially in chains. * Experimentation is useful, for new features or for folks just starting out in the remailer business, but not for stable, longterm, widespread use. (Maybe we need to have the remailers refect their experimental, developmental, and production status with some sort of identifying mark. For example "remailer-X(a)foo.bar" could signify an experimental remailer, and "remailer-P(a)foo.bar" could then signify that the remailer is ostensibly "open for business" as a quasi-commercial, stable remailer. Just an idea. Ultimately, I favor external reputation raters/testers, and this idea is just intended to encourage people who _know_ their remailers are "experimental" (read: flaky) to label them clearly as such.) * Some sort of "reputation" rating, with %availability, would be useful. Something like: remailer(a)foo.bar 37 successes in 41 tries over 131 days 11 successes in 11 tries in last 15 days average delay: 3.1 min (including all overhead) supports: PGP 2.3a, 2.4, delays, subject line remailer(a)loser.org 3 successes in 39 tries in 128 days 0 successes in 11 tries in last 15 days average delay: 47 min (including all overhead) I will be willing to pay about $10 a year, real money, for someone who will set this up, reasonably robustly, and then mail me the results on a daily or weekly basis. (Such a pinging service should be done, I think, on at least a daily basis, possibly even more frequently, with statistics compiled about delays, percentage of hits and misses, etc.) This "Daily Remailing Form" would be an obvious thing to sell: it represents value, is of relevance to Cypherpunks, and can be bought with real money (or with Magic Money thingamajigs, at the discretion of the seller). It might be "better" for the "rest of us" if this service were free, as with the finger ping that was to exist at one point, but this free service fails to incentivize the creator to really make his service reliable and robust. * Digital postage is an even more-ideal solution, strongly incentivizing remailers to keep their systems running. I and others have written about this extensively, so I won't here. Just some comments. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0