December 2003 - cypherpunks-legacy

PGP2.7 & RE: Where is SecureDevice? & PGP 2.7 wuarchive directory missing..
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

PGP 2.7 from viacrypt is now shipping. The main reason for the upgrade (in my opinion) is compatibility with 2.6. They did add some extra stuff though. They are also working on a Windows version to be ready this summer (according to their letter) and I am using their WinCim/CSNav version at home when I use CI$. > P.S. Does anybody have a FAQ or something about how to > integrate PGP with Microsoft Mail? (Note the lack of > a PGP signature while I'm getting my act together..) I asked the same thing of Viacrypt. I lost the reply but it essentially said that they are working on a DLL toolkit to make it easy to integrate PGP into other Windows applications and are looking at MS Mail among others. 2 -- C -- ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

RE: PGP2.7 & RE: Where is SecureDevice? & PGP 2.7 wuarchive directory missing..
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

---------- >From: Claborne, Chris at SanDiegoCA >To: cypherpunks >Subject: PGP2.7 & RE: Where is SecureDevice? & PGP 2.7 wuarchive directory >missing.. >Date: Wednesday, July 06, 1994 6:42PM >> P.S. Does anybody have a FAQ or something about how to >> integrate PGP with Microsoft Mail? (Note the lack of >> a PGP signature while I'm getting my act together..) << I asked the same thing of Viacrypt. I lost the reply but it essentially said that they are working on a DLL toolkit to make it easy to integrate PGP into other Windows applications and are looking at MS Mail among others. >> OOPS... I found it. They are adding a way to have PGP automatically add some cleartext on ciphered messages.... "...A version for MSMail..... We intend to have a windows toolkit version available by September. With this windows version, we can then start work on integration into the various mail programs. MSMail is on the list. Stay tuned... check back with us as to our progress. If you have any further questions or concerns, please feel free to contact me. Best Regards, Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 2104 W. Peoria Ave Phoenix AZ 85029 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41" 2 -- C -- ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

RE: "Cypherpunk" vs. "Cryptorebel"
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

On Wed, 6 Jul 1994, Lefty wrote: > >I like the label "cryptorebel" better than "cypherpunk". The word > >"punk" just does not seem right, while "rebel" does. I do have a > >certain attachment to "cypherpunk". Comments? > > If it weren't for nitpickers, we'd all be knee-deep in nits. There is too much "name recognition" in "cypherpunk" for it to be dropped now...IMHO. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Misattribution
by Jeff Gostin 17 Dec '03

17 Dec '03

"Claborne, Chris at SanDiegoCA" <claborne(a)microcosm.sandiegoca.NCR.COM> writes: > From: Jeff Gostin<jgostin(a)eternal.pha.pa.us> >> can't be broken in a reasonable amount of time. I'm interested in what >> most of the people on this list would consider a reasonable amount of >> time though. This isn't from me... *sigh* Misattributed twice in one week. What's this world coming to? :-) Folks, please watch your attributions. I'd like to be quoted for what I do say, and to see that other people get credit for what they say too... Please?? --Jeff

1 0

FW: Physical storage of key is the weakest link
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

<< some suggestion to keep keys secure on floppy>> <<Lance Cottrel writes: If your passphrase is good (128+ bits of entropy), then your private key is as secure as the messages that you send. Although it need be broken only once, I see no real danger of IDEA being compromised in the near future. Given a good passphrase, I would suggest that you want multiple copies of your key to prevent loss or accidental destruction. My passphrase is > 30 characters. Fortunately Mac PGP remembers the key during any given session so typing is kept down a bit. >> If you are really paranoid, keeping your private keys super secure is a good idea. If a bad guy were come and steal them all she needs to do find out your passphrase (using all kinds of attacks.... camera over your desk....) and bingo, they can read all past and future message traffic to you... ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

FW: Kevin Mitnik
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

<< >From Edupage: ******************* FBI HUNT FOR HACKER Kevin Mitnick is wanted by the FBI for suspicion of software and data theft from leading telecom manufacturers and service providers. Among his victims have been MCI and Digital Equipment. An ex-convict, Mitnick was described by one judge as having an "addiction problem" with computers, similar to a drug or gambling addiction. During a six-month treatment program he was prohibited from touching a computer or a modem, but the treatment seems to have failed, and one detective says: "I've always considered him dangerous. I had to go underground. If he targets you, he can make your life miserable." (New York Times 7/4/94 A1) ************************** >> I also read an article in the Pheonix paper saying that he did a wire tap on the FBI guys that were trying to find him... among other things. QUESTION: How do they know it was him? I get tired of the News dudes printing stuff as if it were fact. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Electronic business
by L. Todd Masco 17 Dec '03

17 Dec '03

Pardon me if I sound a little excited, but: tonight, Bibliobytes made it's first customer transaction! As far as I know, this makes us the first business in history (to be melodramatic about it) to conduct business *entirely* over the public networks -- the order w/ CC num was encrypted w/ RSA, we did the verification electronically on our node (true, through a modem to a third party -- we need infrastructure for e$!), and mailed the result back to the customer, all in about 15 minutes. (It'll get faster as I write the automation code.) Am I correct? Are we the first? (And we issued a PGP-signed receipt, too!) -- Todd [BTW, I acknowledge that I snagged the T. Jefferson quote from someone here on C'punks. It's just too appropriate -- thanks!] -- L. Todd Masco | Bibliobytes books on computer, on any UNIX host with e-mail. cactus(a)bb.com | info(a)bb.com | "Information is the currency of democracy."

2 1

More Mitnik
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

chris.claborne(a)sandiegoca.ncr.com wrote: > I also read an article in the Pheonix paper saying that he did a wire tap >on the FBI guys that were trying to find him... among other things. YES, whether it is true or not that is exactly the sort of stuff we need to get Joe Lunchbox saying "YES!"--and getting Joe Lunchbox on our side* is more important that you know. (Who do you think held down the tax on the beer I am drinking right now? That's right, it was Joe, and I admire that.) We need to watch our image, and Mitnik (if he is smart) is a great way to distact from the pedophile scare. How can people get indignant when they are too busy laughing? The idea of one social misfit wire tapping the FBI (and they want to put wiretaps in the *design*?) is so entertaining--and understandable by Joe Lunchbox--that I can't stand it. -kb * Our side: strong crypto without backdoors for either Mitnik or Freeh is good. Agree? -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

1 0

Tim May and Security for The Millions
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Tim (yes, it was me--Kent Borg--you quoted the most recent time you said--roughly--that other people's security is no very important to you), there is a very good reason why you want *everyone* to have good security. The fact that "everyone" will use up the snooping resources of the TLAs, leaving less for them to throw at you, is not the main point, for the TLAs might come up with clever secret approaches which allow their resources do amazingly efficient things. What you really want to know is what the state of the art is inside the NSA, what efficient things they can do. (You want to know the *whole* story behind the S-boxes, what Skipjack is, etc.) The best way to do this is to badly, I mean *BADLY*, tempt them to tip their hand. If pedophiles (the canonical/mythical threat) are the threat they see then put the best security we (on the outside) have in the hands of the world's pedophiles and watch the prosecutions. Either the TLAs tip their hands by cracking the 1998 version of PGP 5.0.2 with IDEA^3 or they don't. If they do, you know they cracked it. If they don't you know one of two things: 1) They didn't crack it. 2) They did crack it *but* are too afraid to say they cracked it--which is nearly equal to not having cracked it. (Preventing them from acting on information is close to denying them the same information--the Coventry Legend and all.) A wonderful way for us to drive cryptological research out into the light is to *temp* them into showing their hands, and giving good security to *everybody* is the best way to do that. Following this argument, preventing trivial "quick brown fox"-attacks is part of the job of giving good security to everyone, make them work at the interesting problems. Conclusion: my recent "passwords are hard" tirade is not completely off-subject. More general conclusion: user interface issues ("My Mom" et al) are very important. Certainly, working on the gaping hole of Tempest attacts is very important (any ideas?), but don't forget that RF-snooping of moving notebooks requires risky ~field work~ and bad take-out food, something properly high-tech TLAs hate. Tempest attacks are only worthwhile against juicy targets, while some other attacks are useful in bulk. (For examples of how poor passwords are useful in bulk, read RISKS, use your imagination, and extrapolate to large populations.) Tim, the best way for you to have good security is to put good security in the hands of the millions. -kb, the Kent who can sometimes get personal and use first names -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

1 0

RE: Kevin Mitnik
by Random H0Z3R 17 Dec '03

17 Dec '03

Kent Borg wrote: > I am under the impression that I would not like Mitnik personally, but I > have never personaly met him... > Would I turn him in? Well, put it this way: I would not harbor him but > neither would I work very hard to figure out where he is or whether a > particular "nobody" on this list be him. Somehow, I get the idea that the "nobody" you're referring to is yours truly. Well, I'm not him, but your suspicion does bring up a valuable point, though: if you're suspicious that a certain "chained remailer user" is the infamous Mr. Mitnik, then certain TLAs might also share that suspicion. Therefore, anyone using such "underground" services as anonymous remailers should use exceeding care. If they start to use traffic analysis, or any of the other "sigint" techniques discussed here, even though you aren't Mr. Mitnik, you may well get "caught" in their "dragnet".

1 0