December 2003 - cypherpunks-legacy

HELP! Unnerving MacPGP Glitch!
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hmm. Seems the Curve Software public key I sent out has a "bad signature" attached... namely my personal PGP key, with which I signed the new key. Here's what happened -- perhaps someone can explain why: I generated a new key for Curve Software, and signed it with my other key, while it was in my secret key ring (should be ok, right?). I then extracted the new key to an ascii file. When this new key and signature are added to my public keyring, it tells me that the signature is bad. I then select removal of the bad signature, and MacPGP gives me a dialog that says "File pubring.$01 already exists. Overwrite? (y/n)" If I select "yes", I get the dialog back over and over. If I select no, the dialog goes away and the Curve Encrypt key ends up in my public key ring, _with the signature still attached_. Now when I verify the signature of the key while it's on the ring, it is flagged as valid. What the hell? It must have something to do with having signed a key on my secret ring, which was kind of a weird thing to do, I guess. And now I'm all worried that somehow I've compromised the security of one or both of these keys. The second problem I have is how to correct the bad signature in all the copies of the Curve Software public key that are out there? Should I leave the bad sig in there and sign it again? Should I remove the bad sig and re-sign it? Should I just issue revocation certificates for everything and start over? Seems like it ought to be all right to remove the bad sig, re-sign the key, and post the same key with the new signature to the list, signed with itself so that people who already have it in their pubring can verify its veracity. Still, this will be good fuel for paranoia -- "here's the public key for verifying this encryption software... OOPS! screwed it up, here's a NEW key!" Advice appreciated. I don't want to release the code to the Beta testers until this security issue is resolved. -- Will -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLP8JZPfv4TpIg2PxAQGaIQP9GW5D5c695lys23opUDogxlIEvFuCDnKS GK9F5zsAWSwcXLxvRg05Wr59+/xtLPAxWat+wsdg5hdVCXFMECPCALwgC75H0Vpw 2wql24ZobSwJFLY+AXDSxscMUwZwLr5j9PtN6GL/EUubRihH7JXs2tzsupvdlde8 j5p0J5ZvwhM= =1aLJ -----END PGP SIGNATURE-----

1 0

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

1 0

Re: MIT Keyserver
by frc%bwnmr4＠harvard.harvard.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN OF PGP DECRYPTED TEXT----- > I am sorry to announce that the PGP Keyserver at pgp.mit.edu > (a.k.a. toxicwaste.mit.edu) has to be shut down. The processes involved > The keyserver will remain down for an indefinite period of time. > Unfortunately there is nothing I can do at this time. I'm sorry for > the inconvenience this may cause. > -derek - -----END OF PGP DECRYPTED TEXT----- OK this is the second keyserver to go down in a month. Anyone want to tell us why? Derek, I appreciate that you can't prevent it but a little more explanation of why would be much appreciated too. FRC - -- #include <hdrs/disclaim.std> /* Neural N ts catch only dreaming fish. */ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLP+GfLbAlE4AqlTZAQHuIgQAnD6jkd8ZZjQvwe9XkfUZ7AYAeVCKI/CW Abk3HJBK2o+uEeWv+D75iI8l8UmZn/0lMjwTqws5qllR3VE97CVQrvaEef+rXBn7 rBK+5Nm64siGW53eggETCfq9Y1tEvujegJRHmTId8VRVtJkCYgYTnr8BRjvl1Ssk VYHgv9W1cu8= =WdMI -----END PGP SIGNATURE-----

3 2

ID hacking Pointer
by frc%bwnmr4＠harvard.harvard.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For those who are interested, someone has started a thread on the Fringeware mailing list about spoofing and nyms.... The consensus (of 2 messages) is that the dreaded PSUEDOSPOOF is a bad thing... Anyone know if LD is on the fringeware list? FRC - -- #include <hdrs/disclaim.std> /* Neural Nets catch only dreaming fish. */ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLP+MGrbAlE4AqlTZAQGUvAP/ZD9GitZBYQo6F32vrC9Skiu/1rrtY93Z IP4br5fyctNKvwAeC4cpTla6DDokm6ixhUNLQjlKsIFb1blu8qWroUIyemTxhFxZ YSuvlcIQJeR+29kRGhQN7EHps5l72lvEdScWAbAnuzA/teNxtS00P+v28YWp5aUh A9SsnL/ooos= =6RdN -----END PGP SIGNATURE-----

1 0

This was sent to me from reliable sources but is UNAUTHENTICATED -- If you don't want to read abou it on the front page, don't put it in writing
by Stanton McCandlish 17 Dec '03

17 Dec '03

Just passing this on. It should be of interest. It may have shown up here already, but for those that missed it, take a look-see. >Here's the full text of the memo from TCI Cable COO Barry Marshall to the >troops: > >As we move into the regulatory environment, it's important to remember >something vital ... Under regulation, we can't simply adjust our economics >anymore. We have to take the revenue from the sources that we can, when we >can. To that end I want to remind each of you that the transaction charges for >upgrades, downgrades, customer-caused service calls, VCR hookups, etc. are >vital new revenue sources to us. We estimate that by charging for these >functions we can recover almost half of what we're losing from rate >adjustments. > >We have to have discipline. Much like the install fee problem, we cannot be >dissuaded from the charges simply because customers object. It will take a >while but they'll get used to it...they pay it to other service providers all >the time..and it isn't free with the phone company! > >Please hang in on this and installs, and we can still have a great fourth >quarter when we have out heaviest volume. The best news of all is, we can >blame it on reregulation and the government now. Let's take advantage of it! >--------------------------------------------------------------------------- > >My comment: there's nothing really outrageous here until you hit the last >paragraph. They're allowed to set certain charges under the Act and FCC >rules. Do you often not take a tax deduction you're entitled to under the IRS >rules? > >But the tone anchored in the last graph is outrageous. Remember that New York >Times rule, kids. If you don't want to read about it on the front page, don't >put it in writing. No guarantee is made as to the accuracy of this, of course. If anyone has any REAL information on where this came from originally, I'm all ears. -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G

1 0

War on Keyservers
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm sure I'm missing something obvious here, but why are all these keyservers being forced to shut down? The possession of PGP *keys* should be perfectly legal, no? Or is the logic the same as that used to close down drug paraphernalia shops: if people are buying bongs, they must be smoking pot, and so we can't allow it? And exactly what grounds does PKP have for suing? Is it because the servers themselves are using PGP, rather than just storing keys? What if a server is using a legal (ViaCrypt) copy of PGP? (Problem: this argument can only be used for DOS boxes currently.) --Dave. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLP+fvsfNklulBrsJAQGTCQP8DFF77E7zpB6nOzAwcLNbEgezVjt/yQTg DEtdmeY+hO9rcOUJoXwWMPbai2EhBHiyriAMYD5kcHrsbdiS99PW5A5kh4htaFDr Zrrkmn7KK0LXNL0fo2aJZVLKpiy9FxcJPmQvasTqe6EVltxbi4coTNR1wUoD5FE8 0sGj9AsGr+s= =2tQH -----END PGP SIGNATURE-----

1 0

Where's the Pool?
by an4914＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Pardon my ignorance, but I'm new to all this... Where do I find (and how do I use) e-mail "pools"? As I understand it, they're supposed to help foil traffic analysis... right? (Incidentally, I received my copy of _Applied Cryptography_ with amazing speed. I only ordered the thing this week, and here it is! Now I've only to find the time to read it...) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLP+G+uyu9liBvjrdAQFVOQP/ZAuVO/2A2A9nijQCv753CL1qPg9ex/Xv MqNSRXOgow9dGRTf6/r97pKeHqJ3LMImIUb/6GzqJ3QbXdgVbTc4W5NTOd5ajoFc Gi6bVPXQabLV6Y8+JpIcqu1SNmihCM401XdmSWIka1uXDF5F8bJaebXHgzXZ3UvP APcpX8pQcO8= =AVfS -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Address query
by Isaac.Norby＠f217.n125.z1.FIDONET.ORG 17 Dec '03

17 Dec '03

Could someone here netmail me the address for Mike Godwin of the EFF? I should like to ask him about some issues he brought up here a couple of months back. Thank you. ___ Blue Wave/QWK v2.12 -- Isaac Norby - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!217!Isaac.Norby INTERNET: Isaac.Norby(a)f217.n125.z1.FIDONET.ORG

1 0

Applied Crypto can be a menace to you anonymity?
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

>From: an4914(a)anon.penet.fi (Nitch) >....I received my copy of _Applied Cryptography_ >with amazing speed. I only ordered the thing this week,...) If I were the NSA (or, rather, someone who cared about who was using crypto in a way I might not approve of), I'd be keeping tabs on who ordered this book! ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

2 1

NSA, PGP, Cracking Keys, Recent Arrests...
by Jim choate 17 Dec '03

17 Dec '03

On the topic of the deduction that the NSA can now crack PGP because of an arrest is probably faulse. It is much more likely that they were informed on by family or a direct member of the organization. There is no way that any crypto system can prevent defection or protect against it.

1 0