December 2003 - cypherpunks-legacy

Re: Transparent Email (WAS disable telnet to port 25)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 1:34 AM 11/28/94, Alex Strasheim wrote: .... >The big problem with transparent encryption and signatures is key >distribution: if you've never sent a letter to me, your mailer will have >to get my key (invisibly) before the mail can be sent. The big problem >with key distribution is the web of trust: who gets to decide which keys >are good? .... If I have never sent you mail, consider how I got your e-mail address? You could have sent your public key to me along with your e-mail address. If your public key is too big you could include a phoneticized secure hash of your public key and I could check big brother (the CA). I suspect that initial bits of a public key serve pretty well as a secure hash. Perhaps all email addresses should be accompanied by such a hash. The more initial bits the harder to find a fake public key with sutiable mathematical properties and initial bits that agree with your real pulic key. If an email address and its associated PK are sent thru unauthenticated channels a man in the middle can substitute the PK. In the same situation, however, the man in the middle can substitute the email address! ....

2 1

Re:
by RGRIFFITH＠sfasu.edu 17 Dec '03

17 Dec '03

> >Realizing this is somewhat off-topic, has anyone heard of the >'internet liberation front'? > >- spooge > > According to today's WSJ it's the name used by hackers who broke into Pipeline Services, an Internet access provider in NY. Their intrusion was detected and stopped before major damage was done. They posted a message that "warned corporate America against commercializing the Internet into a 'cesspool of greed'."

1 0

Transparent Email (WAS disable telnet to port 25)
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > I don't have an answer to your question, but you did bring up something > I've been meaning to ask about for some time and I never really got > around to it; Are there any short-term plans to press for an RFC > utilizing digital signatures? With the exponential increase of mail > users, as well and the influx of Compu$erv, AOL, Prodigy and other users, > some methods for the transparent use of digital signatures needs to be > worked out before it becomes too difficult to implement change because > the commercial services have all the power. (or worse, before the > government decides for us.) Some still unformed thoughts on this subject: The big problem with transparent encryption and signatures is key distribution: if you've never sent a letter to me, your mailer will have to get my key (invisibly) before the mail can be sent. The big problem with key distribution is the web of trust: who gets to decide which keys are good? This is a subtle advantage that systems with centralized key generation have over systems like PGP, which let users generate their own keys. If big brother mints all the keys, then big brother can set up an authoritative keyserver. The best answer that I can come up with for this problem is to allow for several webs of trust to function simultaneously. Perhaps we would have a default web, which would have everyone's key in it. The idea behind the default web is that it should be able to return a key as often as possible, so we don't want to make it too difficult to submit keys for this web. But anyone else could devise his or her own web, and administer it however he or she pleased. A request to a keyserver would include a list of webs, in order of preference, that the user would be willing to deal with. At the end of the list would be the default web, in case nothing better was available. A web could be defined by a single top-level public key and a set of rules. Perhaps a text based program -- a sort of "meta-pgp" -- could check chains of signatures to validate a key. Suppose, for example, that I'm administering a web of trust. I set up the web so that I can deputize notaries who can in turn sign user keys. Lets further assume that all signatures are good for a year. A keyserver would return a text file containing: (a) the user's key, concated with a header specifiying the date it was signed by the notary, and (b) the notary's key, concated with a header specifiying the date it was singed by me. We'd want "meta-pgp" to be able to handle complex rules which would give it the flexibility to implement a wide variety of webs. Perhaps it could use prolog-ish style induction to determine if a key was good. Does this make sense? Is it something that was already proposed and discarded? == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtmV+hEpP7+baaPtAQH3kgP8DmycpNrZKQRpyK1rclxJnIY2bdT5m4iM p7IQ7nI07PSMn+ldye2xG5jjms42CR0BVvk4hhdGzDJwcgdd3FHFC7xNHvhk+SOE 4EHqpyW+YdNSe3A7+sMZp30mgWEnvHOpnrU9UiMUIaC8gcLk3GlkXdxDG+SWGwv/ 1yesnbaUxYM= =p2UQ -----END PGP SIGNATURE-----

2 1

Re: A possible solution
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > The use of cryptography makes it virtually impossible to know anything. > If everyone used to PGP to communicate. I mean everybody in the whole > entire world. There would be no possible way to ever know what is going > on. What about signatures? You know (or at least you could) that I wrote this note, thanks to PGP. Crypto doesn't just hide things, it can establish indelible trails as well. In this particular instance, PGP has added to what you know, because the signature has added information to the post. Crypto isn't just about secrecy: it gives us a set of tools that allow us to have a great deal of control over how much of a trace our actions will leave, and who is able to see that trace. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtpzdxEpP7+baaPtAQEL2gP/afzRoPmDWYKWdOl7u4O4qDgB8QiQjzla RrKShPfmXK0U06eU5Wran1VYKYOaGkoRhQbZQXQ8T33sbFNHWKYPcDcYpXT6kkqu dT/AHcp/wuCYp0oeb65qYhuiemus0cFPWzfPujOkwKnm8r57lz9S8YVeSMHQzWrv glLORANPoO0= =r1q5 -----END PGP SIGNATURE-----

1 0

Forwarded message from comp.internet.nethappenings
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Path: voxbox!hypnos!malgudi.oar.net!caen!zip.eecs.umich.edu!newsxfer.itd.umich.edu!gatech!howland.reston.ans.net!usc!news.cerf.net!noc.cerf.net!news-mail-gateway From: sackman(a)plains.nodak.edu (Gleason Sackman) Newsgroups: comp.internet.net-happenings Subject: WWW> Digitale Burgerbeweging Nederland DB.NL (fwd) Message-ID: <Pine.3.89.9411271743.D13938-0100000@plains> Date: 28 Nov 1994 06:57:26 -0800 Sender: daemon(a)CERF.NET Distribution: world Organization: CERFnet Lines: 34 Approved: usenet(a)noc.cerf.net NNTP-Posting-Host: noc.cerf.net - ---------- Forwarded message ---------- SENDER: mwharing(a)cs.vu.nl (Haring MWA) Subject: ORG> Announce: Digitale Burgerbeweging Nederland DB.NL Date: Wed, 23 Nov 1994 19:38:20 GMT =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Digitale Burgerbeweging Nederland ..sticking up for the interests of digital citizens... On Saterday 15 October the dutch db.nl (digitale burgerbeweging nederland) organization was founded in Amsterdam. Some of our items are: o digital democracy, citizens' rights such as freedom of speech, protection of privacy and involvement in policy making. o socially valuable applications of information and communication technology o an accessible and user friendly digital public network The organization was founded in reaction of government plans to ban cryptografy, and regulation wich would forbid public libaries to lend electronic information. For more information you can check out our web-pages. WWW: http://www.xs4all.nl/~db.nl fax: +31 20 6239761 phone: +31 20 6200174 e-mail: db.nl(a)xs4all.nl snail-mail: P.O. Box 18624 1001 WD Amsterdam =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLto+5t74r4kaz3mVAQHM9AP+KVFGtjrTPAC3ep8xbbxUM3+woy9i+43l 9ZZTNXVXHjUoymlvpCpooJnP/qp4+KKIuZIjqz7clhCJpU/hH3K8Yd1ROTyVyT50 ou8CUXod4j0vYq2O1HL7nZnkV6PVqGDcDtlfE1nOVtWyYjuoy3nk1+QST3mXNny3 LgL/wDP3ezo= =s1H2 -----END PGP SIGNATURE----- ... "The greatest dangers to liberty lurk in the insidious encroachment of men of zeal, well meaning but without understanding." - Justice Louis Brandeis -- jgrubs(a)voxbox.norden1.com (James C. Grubs, W8GRT) Voxbox Enterprises, 6817 Maplewood Ave., Sylvania, Ohio 43560-1956 Tel.: 419/882-2697

1 0

MIME meme continues... New internet drafts
by Eric Blossom 17 Dec '03

17 Dec '03

[ Perry, hit "delete" now... ] Here are a couple of more internet drafts relevant to secure email. ftp://ds.internic.net/internet-drafts/<filename> Title : Security Multiparts for MIME: Multipart/Signed and Multipart/Encrypted Author(s) : J. Galvin, S. Murphy, S. Crocker, N. Freed Filename : draft-ietf-pem-sigenc-02.txt Pages : 10 Date : 11/23/1994 This document defines two new content types for specifying the application of security services to MIME message bodies. MIME, an acronym for "Multipurpose Internet Mail Extensions", defines the format of the contents of Internet mail messages and provides for multi-part textual and non-textual message bodies. The new content types are subtypes of multipart: signed and encrypted. Each will contain two body parts: one for the protected data and one for the control information necessary to remove the protection. The type and contents of the control information body parts are determined by the value of the protocol parameter of the enclosing multipart/signed or multipart/encrypted content type, which is required to be present. Title : PEM Security Services and MIME Author(s) : S. Crocker, N. Freed, J. Galvin, S. Murphy Filename : draft-ietf-pem-mime-07.txt Pages : 34 Date : 11/23/1994 This document specifies how the services of MIME and PEM can be used in a complementary fashion. MIME, an acronym for "Multipurpose Internet Mail Extensions", defines the format of the contents of Internet mail messages and provides for multi-part textual and non-textual message bodies. PEM, an acronym for "Privacy Enhanced Mail", provides message authentication/integrity and message encryption services for Internet mail messages.

1 0

RE: Cash
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>>On Fri, 18 Nov 1994 wcs(a)anchor.ho.att.com wrote: >> >>> Hasn't really provided it for quite a while, as long as there's an >>> infrastructure to track serial numbers (you've presumably noticed that >>> each bill a unique serial number, except for counterfeits and maybe >>> printing glitches.) >> >>And every bill that passes through my hands (of course not the ones I >>handle at work, I'm talking personal here...) gets the serial # >>overwriten in heavy black marker. >> >>Happy Hunting, -Chris. > >I went to a GSA auction and picked up 3 very nice U.S. Gubment surplus >paper shredders. They shred into very fine particulate that makes great >fire starting material for the fireplace. >I run everything with my name, address, etc., thru it so that *none* of >my trash is identifiable. >How's that for paranoid :> > How much would you want for one of them, assuming there's one for sale? Dave "Getting more paranoid by the minute, sometimes" Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Re: A possible solution
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 5:35 PM 11/28/94, Aron Freed wrote: >Ok. You all have basically defeated the stiffer fines issue. > >The one issue remaining is do we want to live a life of anarchy. That depends on what you mean by "anarchy." I'm sure there are a few anarchists on the list, but they probably don't mean the same thing as you do by "anarchy". > Do we >want to live in total isolation? Do we want to be completely paranoid and >be always looking over our shoulder? Many of us already are. Except the kind of rules you are describing would increase our paranoia, not lessen it. The people we're already looking over our shoulder for are the people who would be enforcing the rules you are proposing. >You tell me how we solve that >problem. I still don't understand what "that problem" is. How does the existence of cryptography (which is of course what started this discussion. fittingly, since we're on cypherpunks here) make anyone live in total isolation, or be completely paranoid, or be always looking over his shoulder? I don't understand how strong cryptography does any of those things. What exactly is this "problem" that you see, and how is it related to cryptography? >I for one do not want to touch "1984" territory, but I don't >want to live in an anarchy either. About half the people I talk to think we're already "touching" _1984_ territory, and about the other half think we're already living in an "anarchy", so appearantly it's in the eye of the beholder. They mean "anarchy" in a negative sense of course, the same as you. I wouldn't mind living in an anarchy if it's the kind Mikhail Bakunin or Emma Goldman or Alexander Berkman or Petr Kropotkin advocated. You might pick up a book by any of those authors at your local public library, you might be surprised.

2 1

Secure EDI over Internet
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Summarized from PC Week, Nov 28th, page 44: -begin- Premenos Corp now testing product to foster Electronic Data Interchange transactions over the Internet. Technology licensed from RSA Data Security Inc provide the security features, encryption, authentication, and guaranteed message delivery. Carl Redfield, VP of manufacturing for Cisco Systems Inc, was quoted as saying, "Security is the most important factor to us, as it is now, anyone could intercept messages off the Internet." Cisco is involved in testing the new product. The Premenos suite will be available first quarter 95. Pricing not set. These phone numbers were given for more info: Premenos (800) 426-3836 Cisco (800) 553-6387 -end- regards, -pd-

1 0

Re: How to disable telnet to port 25
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The Al Capone of the Info Highway says: > > A while back, there was a discussion about how to fake a from > > address by telneting into port 25 in a site. Many people discussed > > the pro's and cons, but I wanted to know if anybody knows of a way > > to stop people from getting in there to send the message in the > > first place. > Sure. Turn off mail to your site. You don't have to go quite that far (almost, but not quite :-) You can do things like only accept your incoming mail via uucp, which has a whole different set of holes and limitations, but which is supported by a number of the major network suppliers. If you're on dialup access anyway, uucp is fine. If you've got a real IP feed, uucp-over-tcp has slightly more authentication than smtp, and can turn off anonymous access, but that basically means you're transferring your trust to your MX forwarder's security system, which presumably still speaks port 25. Bill

1 0