December 2003 - cypherpunks-legacy

Anarchists break rules, details at 11, was: The Market for Crypto--A Curmudgeon's View
by Pat Farrell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- eric(a)remailer.net (Eric Hughes) writes: > One underlying premise of Tim's argument is that the presence of these > actions at the server makes his life harder. > In what way? The server will not require a digital signature. > Unsigned messages will still be sent to the list. There need be no > change in the way that one sends and receives mail. > I refuse the argument that toad.com server actions make anybody's life > harder. A few days delay, which is what I think we are talking about, will clearly make following threads more difficult. And add to noise on the list, as the content of an early-non-signed message may be repeated and signed by someone else later on. After netcom's recent mail mis-delivery problems, I know all too well how hard it is to participate in discussions that are delivered in random-appearing order. A few hours delay will be indistinguishable to the netcom subscribers. My experience with rules and PPLs on other lists has not impressed me. YMMV. Whatcha trying to do, eric, lead that anarchists? Pat -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLtuEc7CsmOInW9opAQE/wAP+OmPDe8vD7/D5WvZpGvecPgec8oT9/sqN ghMf+uxUwiVfxe2NuSDCKrVcipYAV6h+Q3QRo/o4FijlwleT2wmaL8yxoBT5KffN SQAVINfx6n9Hb0hxH3md8JdOYD5jyOpPhEMh5JyaEUetNfK0bnXCzVUsj5v20SXp E7KXxmAZqPc= =SV9C -----END PGP SIGNATURE----- Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Dr Dobb's Info Way
by John Young 17 Dec '03

17 Dec '03

Dr. Dobb's has a special Winter issue on the "Information Highway" which includes a good long article on the economics of the system, past, present and future, and another fine piece on e-mail security by Bruce Schneier. That's Winter 1994, Volume 19, Issue 14.

1 0

whats all this nonsense
by Tom Bryce 17 Dec '03

17 Dec '03

I just signed onto this list. What the hell is all this nonsense that I hear about mandating PGP signed messages? I thought the whole grassroots crypto thing was about protecting privacy rights and individual liberty and all that. So what if someone wants to post a message to cypherpunks AND DOES NOT WANT ANYONE TO BE ABLE TO PROVE THEY WROTE THE MESSAGE. Whether because they fear legal prosecution, or some other social consequence down the line, or whatever. It's everyone's personal choice whether they want their name nailed down unmistakably to given messages of personal/political/WHATEVER nature. It seems heinously against the spirit of this list to mandate that pople append an unforgeable digital signature to everything they feel like saying to the list so that anyone, anywhere can prove that they said a particular thing at a partic time. If you have a problem with what someone said and want to verify its authenticity, why not just send them an email and ask them to sign the message personally? Tom

3 2

Stego paper
by Adam Shostack 17 Dec '03

17 Dec '03

There is a paper on stegonography "Minimum Protocols for the Insertion of Messages into Random or Pseudorandom Data" posted to sci.crypt.research. From: klockstone(a)cix.compulink.co.uk (Keith Lockstone) Message-ID: <3benes$pbh(a)net.auckland.ac.nz> Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Mac Encryption Components?
by acspring＠knoware.nl 17 Dec '03

17 Dec '03

Does anybody know if there is an encryption component registered with Apple? I was planning to write one, but I wanted to know if there was already a standard/spec I could code to. I e-mailed REGISTRY at AppleLink a coupla weeks ago, but they seem to be focussed just on registering new components; not fielding queries about what's already registered. -- Man! Woman! Child! All! are up against the WALL of SCIENCE! <acspring(a)knoware.nl> PGP Key print:4C 17 EC 47 A1 6D AF 67 F3 B4 26 24 FE B2 0F 5E

2 1

Re: The Market for Crypto--A Curmudgeon's View
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: eric(a)remailer.net (Eric Hughes) > Let me review the exact proposal. First, a recognizer is set up at > toad.com to distinguish between digitally signed and unsigned > messages. Second, some action on the message would be taken, which > would gradually increase in effect over time. The first action would > be to add a header to the end of the mail identifying it as unsigned. > A later action would be to delay the mail at the server for some > amount of time. A final action would be to delete or bounce messages > that weren't signed. Perhaps something a little more useful would be a little more palatable. I have a feeling that something like the above would sound gratuitous to many on the list. A better way would possibly be to have some value-added service offered by the list server which involves encryption or digital signatures. Here are a few ideas: 1. What if all messages on the list were themselves signed by "Cypherpunks List <cypherpunks(a)toad.com>"? (yeah, I'm reaching here; let my brain warm up...) 2. Encrypted submission to the list. This could be useful if used in tandem with remailers, perhaps... 3. Offer anonymization locally. Messages posted this way could appear as "cypherpunks-reader@somewhere" or something like that. When combined with remailers and encryption (like #2 above), this could mix things up with respect to anonymous mail. As another (possible) option, the remailers could be set to recognize cypherpunks(a)toad.com and send in such a way as to use this local anonymizing. 4. Auto-verify signed messages. Put a header at the top of signed messages such as: [Signature verified. ID: Joe Blow <jblow(a)uunet.net>] [Bad signature! ID: Joe Blow <jblow(a)uunet.net>] for tested signatures. This would either require a key registry (where you register your public key with the list server) or an interface to the key servers. This would of course imply quite a few changes to the list server code, as well as possibly non-trivial resources to do the processing, but hey, social imperatives don't have to answer to reality, now, do they? (At least they never seem to when the government is concerned. :-) Two variants: Strip the signatures after verifying them, and/or marking unsigned posts in a similar way. 5. Allow the option to encrypt list messages before sending. If we used #4 above, this could encrypt with the public keys; otherwise, it could use conventional encryption. This could be a great boon to readers whose sysadmins might take a dim view of them reading such an antisocial list. :-) Corollary: allow the option of sending the list, encrypted, through the remailers as well without requiring a pseudonymous remailer. I'm sure I could think of more lamebrained ideas given enough time and motivation. :-) > I do, however, agree with the other two premises of Tim's > hypothetical. I do think that crypto isn't being used by enough > people. I realize that the exact meaning of 'enough' is subjective, > so let me rephrase. I do think that crypto is being used by fewer > people than I want. I also believe that setting an example is a good > thing, because it signals an achievable task to those who are > considering doing it. I would agree, though I would suggest that holding out carrots (neat features you can take advantage of if you encrypt) would work better than punishments (your posts won't get through as fast if you don't sign your posts). Does that make me a Puller? > When I first proposed server actions last year, it was with the full > realization that I wouldn't be signing my own posts and would thereby > be subject to the delay (the first-proposed action). This post isn't > signed either. This post is. :-) I'm a believer that it serves as effective spoof insurance. But, then again, I've got a direct Ethernet link to the net on my Windows box at work and Linux at home, so it's easy for me. Also, I wasn't even a lurker at that time, so my suggestions may be old hat. If so, please bonk lightly! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtuijTER5KvPRd0NAQFfXAQAgDrbMlEJBXU2V9NIquHNQGonE/dwwH0I aEnykWh+8Bu3hCdqYgbv6zhe7gc+0itb/QuwHMpUn8MNHE6VhykFPl+i7c3HOibf 0yAqPVy10UNMuJY6LxqSxfrTKwV/sFcnRWDaJcboL3MvTFrwRqC3ItdaOeokKvx2 1Cgv1ioQqfc= =gzbV -----END PGP SIGNATURE-----

1 0

Re: The Market for Crypto--A Curmudgeon's View
by Sandy Sandfort 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Did anyone but me notice that Eric Hughes and Tim May have reached a consensus in the on-going debate about signed posts? Tim says, "your house, your rules" and acknowledges that Eric is the de facto boss of the list. Tim expresses no real objection to Eric's first step except in a "slippery slope" sort of way. Personally, I'm against mandatory digitally signatures as a rerequisite for posting to Cypherpunks. On the other hand, I like the idea of having the list software automatic verify digital signatures. This is a valuable service I'm usually too lazy to perform for myself. Here's my suggestion. Eric should unilaterally impose his first step, i.e., all unsigned messages and messages with spoofed signatures will henceforth be flagged as such. Let's see what effect, if any, that has on the way people post their messages. After the protocol has been in effect for some time, we can re-open the topic for further discussion. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLtulbk5ULTXct1IzAQERKQP/QKtfYC1MNpvxTNPeLTlxJeAcFiTrufKi M3I0vpH3gXRDZeeL+ff/8YyRbkDgYZEOu6Si/fZuiWWZCYNmAQb22QaQ9riW6amq ghIybvhd66i7rOntNIkcXOAGtk6rBJ8AVc3lFqmGEYBRW2p/+mATsAFaJ7Agj5K9 L9nc34T6Mb0= =sDH7 -----END PGP SIGNATURE-----

5 4

Re: whats all this nonsense
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>I just signed onto this list. What the hell is all this nonsense that I hear >about mandating PGP signed messages? > >I thought the whole grassroots crypto thing was about protecting privacy >rights and individual liberty and all that. So what if someone wants to >post a message to cypherpunks AND DOES NOT WANT ANYONE TO BE ABLE TO >PROVE THEY WROTE THE MESSAGE. Whether because they fear legal prosecution, >or some other social consequence down the line, or whatever Of course we all agree with you there, but as someone else mentioned, users would be perfectly free to sign with a _pseudonymous_ key. My key wouldn't have to be in the name of "Jonathan Rochkind," it could be "Dirk the Destroyer", or whatever else I wanted it to be. I'm not sure if Eric is suggesting that everyone submit their public key to the list or not. If he is, then things would be made a bit dificult, as you would have to make your one-time-only anonymous key, send it to toad.com, wait for it to be recognized, and _then_ send your message to the list. Assuming that not only do I not want your messages traceable to Jonathan Rochkind, but I also don't want them traceable to _each other_, then I'd have to make a new key before sending each message, and go through that whole rigamarole each time. I'm not how often people actually _would_ desire to do such a thing (generally, it's important to most people to build up a good reputation, pseudonymous or otherwise), but.... I agree you have a good point that it's important the list be set up so it's possible to contribute to it anonymously/pseudonomously. And that _some_ implementations of what Eric is suggesting might make that either impossible or just a pain in the ass (and we probably dont' want to do either). There are probably other implementations that wouldn't have this problem. Although I would still oppose them, pretty much on the grounds Tim May has been ranting about. (and I do mean ranting in the best way. :) ). People should pretty much be able to do what they want, and I don't see any compelling reason to force people to sign their messages whether they like it or not.

2 1

Jeff @ViaCrypt
by Joe Turner 17 Dec '03

17 Dec '03

Please excuse the bandwith. Earlier today I had a conversation with Jeff who claimed to be from ViaCrypt. I was in a hurry to attend a lunch/meeting and forgot to get his internet address. Could someone point me in the right direction? -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597

1 0

PGP hook for Eudora?
by dmandl＠bear.com 17 Dec '03

17 Dec '03

> Jonathan Rochkind wrote: > > > Because premail makes it incredibly easy to use PGP on a unix box. And, for > > that matter, the Eudora/PGP applescritps make it incredibly easy to use PGP > > on a mac. And there are some people working on an applescript that will I keep hearing about PGP hooks for (Mac) Eudora, but a casual search of at least five advertised ftp sites has turned up nothing. Can someone post an address where this stuff can definitely be found? Thanks. --Dave.

2 1