December 2003 - cypherpunks-legacy

Re: cypherpunk signing service
by owner-cypherpunks＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199412020736.CAA10394(a)bb.hks.net>, <sglass(a)netcom.com> wrote: >Does this look right? > >pub 384/27D5B76D 1994/12/01 Cypherpunk signing agent <cypherpunks(a)hks.net> > Key fingerprint = 85 BA D4 6D B8 9D B6 B7 EB 74 11 48 42 45 61 F2 Yes, that's correct. >| I welcome any suggestions on the format of the message and the prepended >| message. > >Why not stealth it and just appear as if the sender signed it? Because the sender didn't sign it. I don't want to misrepresent what the service does. It guarantees messages have gone through cypherpunks(a)hks.net and, by implication, cypherpunks(a)toad.com. Nothing more, nothing less. >| Thanks for y'all's comments: keep 'em coming. > >Good work. Thanks! By the way, here's the server's key, signed by me: - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQA9Ay7eB60AAAEBgOGkDzo6mkSp3G4W3EXwMWK8SrTVSmosuN5Y7Z2FdBS5uJ3o 1O0XNAwqGc8CJ9W3bQAFEbQuQ3lwaGVycHVuayBzaWduaW5nIGFnZW50IDxjeXBo ZXJwdW5rc0Boa3MubmV0PokAlQMFEC7fdxkTYYKL6zwe3QEBq3kEAJ9WxYXnOVXb yz8bTBJpKWhEVWXzpIq7ApDTjmK6e7GoF+FFsdy7ZTsNLpsDa0huijXRZJ9Fcvcx ioAQVHfNkXr6hFVxFkttztggKMlpzYtfUGnyiR+abgUUkVvEIfn0z5mzfbvnHLSa baZE6VrDFwa8Hnf2GVLLPOBkiLAGZTB0 =CHvA - - -----END PGP PUBLIC KEY BLOCK----- - -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLt93aRNhgovrPB7dAQGRrAP9GS0HAa3zaCCKGUdpH3V+ur5i/YgF2Jxk wY8jlyXz/pazsv8GQw55Nl3bMKwGSkpng6aM9MNV1koGP5BBY1gw2gsVhzYi28QQ +ANreE32N3Rn0Kb2mH8WA88TG+bmWLH/Xs5ABGVIXO08VpLoJjrxuPaCxSBQYvGS XMBDrQ+P07o= =Cdif - -----END PGP SIGNATURE----- - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt932SoZzwIn1bdtAQFZhQGAlORDYu6ulXfhEcIm8JUIcHJHHZKfwzfN 6HP4xRr9Q/0j9HtOkdoHRZ7QoiE2iFrr =ikLM -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: First Virtual?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

FV does in fact have a bunch of e-mail addresses that will auto-forward some info sheets to you. I have attached the info to this message. After having read Doug Barnes message (<9412021548.AA17294@tadpole>) I'm glad I'm not the only one who thinks FV is a joke. The entire security of the system rests on the difficulty of intercepting and forging e-mail. Forging e-mail is dead easy, intercepting isn't much harder. While the implementors are correct that an online payment-system will have to be simple to use in order to gain wide acceptance, sacrificing all security for ease of use is a grave mistake. It just begging to be ripped off, providing people actually sell something via FV worth ripping off. andrew Begin forwared message: Where can I find out more about First Virtual? The First Virtual GENERAL INFORMATION FAQ is the best place to start if you are looking for information about First Virtual. It provides details about all the FAQ documents available via email, and about additional information available from our anonymous FTP and Gopher servers and our World Wide Web database. To receive a copy of the GENERAL INFORMATION FAQ, send an email message to "help(a)fv.com"; the GENERAL INFORMATION FAQ will be sent to you by email automatically. You can also find a copy in other places: * Connect to ftp.fv.com, our anonymous FTP server, and look in the directory /pub/docs for the file called "FAQ- general.txt". * Using Mosaic, Lynx, or another World Wide Web browser, connect to our Web page using the URL "http://www.fv.com". Look for the link to the "Frequently Asked Questions" page. Here's a summary of other First Virtual FAQ documents; to receive a copy by email, send a message to the specified address: * 1-2-3 FAQ -- Steps for getting started -- 123(a)fv.com * SIGNUP FAQ -- Signing up for an account -- signup(a)fv.com * BACKGROUND FAQ -- Our company and our vision -- background(a)fv.com * BUYING FAQ -- Buying information -- buying(a)fv.com * SELLING FAQ -- Selling information -- selling(a)fv.com * INFOHAUS FAQ -- Using the Infohaus -- infohaus(a)fv.com * SECURITY FAQ -- Security issues -- security(a)fv.com * CASHFLOW FAQ -- Flow of money in our system -- cashflow(a)fv.com * PROBLEMS FAQ -- Dealing with problems -- problems(a)fv.com For information in languages other than English, send email to "international(a)fv.com". To help us provide our services to the public at the lowest possible cost, please search the FAQs before sending email to our human operators. Thanks for understanding. And welcome to First Virtual!

3 2

Disclaimer within signed body?
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It's been suggested that I put my "signature disclaimer" within the signed block. There are several pluses and minuses to this, and I wanted to see what others think (As an aside, by the way, I think the aesthetics of the output are important). As Eric pointed out to me last night, in general it's bad to modify the body of a message. I think that what I've been doing is fine, as the clear distinction betweem original message and additional stuff is maintained. However: the disclaimer should really be bound to the signature. Using the "comment" block won't do this, since PGP does not use it as part of the signature. Additionally, people whose software runs the messages through PGP will never see the disclaimer if it's outside of the signed block. What are folks' opinions on this? My options are: - Do nothing. Memory and the general appearance of the disclaimer are enough that people won't be fooled by a message with a removed disclaimer. - Put the disclaimer within the signature block. In essence, doing nothing as above, but that's what the comment block is there for and it might look nicer. - Put the disclaimer at the top of the signed body. Ugly, since it immediately forces its presence in a message, but effective for the same reason. - Put the disclaimer at the bottom of the signed body. It's still modifying the signed body, but in a much less obtrusive manner. Input? - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt+AfCoZzwIn1bdtAQF0uQF/R2+Wc4tKXs0/+Qc79ln01EUOT8seW4wC tKLa8H8CGAI33Exh/FeMvtYjnUEdPcXL =5852 -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

2 1

Voice over data
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Eric Hughes wrote: > the great voice-over-data protocols and products introduced by > Intel, Rockwell, ZyXEL and others at Comdex which will make > Voice-PGP so much easier > > As I understand these voice-over-data products, the voice goes over > analog, added to the modem signal. The modem signal is interpreted, > and then reconstructed and subtracted from the incoming signal, > leaving voice. Very clever, but insufficient for secure phones. I don't think that's how they do it. As far as I know, most methods multiplex digitized audio with the data. One system used by some people in India provides a dynamic combination of fax, (digitized) voice and data, depending on the throughput - eg vox/9.6 data if 14.4kbps, fax as well if 19.2, etc. While Intel and others are proposing standards, ZyXEL does it with software along with a voice card or possibly RJ11 input. A friend of mine saw a demo of it at Comdex, on an old 1496E (16.8 kbps zyxel to zyxel). The new v.34 does 28.8k - lots of room for clear digitized voice and high speed data. This is exactly why I thought it would make secure voice easier, if not secure phones (who wants to lug a modem and PC around as a 'handset'?). I'll be testing some Onetics Rad VFAST modems this week, which apparently do digitized voice over v.34 as well. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Digicash trial
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Geoffrey Faivre-Malloy <vikram!geoffrey(a)crl.com> > DigiCash trial? Tell me more! I got my account a couple of weeks ago, I just downloaded the software. (I'm a buyer, though I was hoping to sell too.) Recent 'shops' include HotWired. I suspect one of the problems is that the software is not 'licensed for use in the US' possibly for patent reasons? It says this clearly in the pre-download license agreement. The trial gives you 100 dummy units of currency, which you can use to 'buy' from 'shops'. > Now THAT sounds cool! :) Wonder how long it will be before someone uses > PGP in a phone :) How much processing power would it take to do that on > the fly anyway? Actually not too much - PGP can process fast enough on a 486 as it is. > > Now what _I_ want is some way to integrate PGP with Netscape... > What's Netscape? The 'new improved' commercial version of Mosaic, by those who left to form a company. The freeware version of Netscape is probably the best WWW browser for a number of platforms right now. Of course, PGP wouldn't be integrated with Netscape as such, but into a local Web page - I'm looking at Web pages as simple interfaces to various ordinary, not necessarily 'netted' tasks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

VOTE NO!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On mandatory sigs: I personally don't fathom the idea (as some of you do), I've always perceived PGP(Tm) as something I would use when I really had something sensitive to send a friend, or when I was making a public announcement to a mailing list or newsgroup. But to use it to sign EVERY single piece of mail I send to cypherpunks is asking a lot from me as my setup is very similar to Tim Mays', and I don't want to be singled out because of it! I think the list should proceed as it has since its formation, and subscribers should just sign their messages as they see fit. I know I'm not posting anything new, but considering the torrential flood of trash that Detweiler posted, it's not that much of a waste. :-)= Good evening.

2 1

Term Emulators (was Re: public accounts / PGP / passphrases)
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: Adam Shostack <adam(a)bwh.harvard.edu> > Derek wrote: > > | It would be nice to integrate PGP into terminal emulators, too, like > | kermit or seyon or red ryder or whatever, so that you could easily use > | PGP locally to sign/encrypt things on the remote end. Wishful > | thinking, I guess... > > I think terminal emulators are the wrong layer for PGP > integration. PGP support is needed in document editors and viewers, > rather than in network layers. I think you misunderstood. I took Derek as saying that 'modem programs' (as in the Procomm/Crosstalk kind) should have PGP integration. If these truly provided a full-featured network, then yes, the focus would need to be on the local editors/viewers we'd all use. As it is, these programs only provide a narrow window into a far-off environment, with varying degrees of security. As a positive proposal, I noticed Greg Broiles's posts with the scripts and came up with an idea. Would it be possibly a step forward to write similar scripts to allow for local agency? I envision two stages here: 1. Scripts on the remote end substituting for your editor that actually run your editor, then ask (once you're done with the plaintext) whether you'd like to process the message locally. If so, it would send the file via sz, wait for a Enter: press, then rz the file back, substituting the rz'd file for the original. You'd still have to mess with files on the local end, though. 2. Local control of the term emulator to automate the local agency part of the transaction. > With direct ip connectivity becoming commonplace, we're seeing > PGP integrated into mail & news tools, which is a great thing. (There > is also a use for encrypting networks, but I think it is different > from the use for PGP, which is a document oriented system.) True. However, the plight of the poor user who must use dial-up to connect is still one where all the agency must happen on the other end of the wire. I don't think these are going to go away any time soon, and by the time they do, we'll probably all have moved on to some new GeeWhizBang system developed commercially (my guess is it'll come out about a year after the RSA patent expires... :-) and integrated via OLE4 into our Windows 5.2 messaging systems (whoops! sorry, Tim, I meant via AppleMindMeld into our System 9.3 messaging systems :-). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt+VqDER5KvPRd0NAQG2JQQAk3dLJW+eoHxqJZbE8Ofcf/oNg7zOgrAJ zjpKwmM6PNFMsvsiI84jBkENHBhaItIMtuPCh+RCR6lS7JVaoAIlLOJ3e+5Kb8uM B9nrZ9BMzro275wjC1Ubmh2+hLtSVRVU0lqoGi7JiEv/fSWdlBCXdLqztiVsMvn5 fMBPqQY07o8= =InPY -----END PGP SIGNATURE-----

1 0

Re: Brands excluded from digicash beta
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

PAP wrote: >I just want, in a short message, let you know that there exist some >satisfied ecash testers (the system itself and the support when we >set-up our digishop and our plain customers cyberwallets). > The only thing I could eventually complain about is that I even received >a second (unsollicited) account Id and password to retrieve ecash >software because of a bug in the requests management :-) I have been a beta tester since the days of the very first Ecash clients which would freeze my computer when run ;-) I am very impressed with the latest clients. They work flawlessly. The only thing missing is off-line transfer capability. Since the current beta has a (dimmed) button for this, I don't think we will have to wait much longer. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: He's the Big Kahuna
by lmccarth＠ducie.cs.umass.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Tim May writes: > Eric Hughes wrote: > > Someone else wrote: > > > I'd feel just about as strange (I hope) if people were saying "Look, > > > Tim's the boss. He's the Big Kahuna. If you don't like his policies on > > > his list, leave." > > "This is one _tasty_ burger" > Something to do with the metric system? Security through obscurity. - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt+fJ2f7YYibNzjpAQEWRAP/d0dYaMQf0R4XZZRuIwW8kzqZj8p/27XA +TDupyHkn2Bpu/02JziAccWbRVLyA8XgVwN69Su1TBrqhRTEI8cQZG7jC/WJ4HHl iYV50CnKyoz3d5peAowI14BD6x7EnJkR70TomnyEsxQhK60E1VDpZDrxV2EsGqNI n9PQpw6SCPg= =woV8 - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt+gXyoZzwIn1bdtAQFQMwF/YbIgSqTwy1c2dGhbGPvZD226C1jgPDfU 6RSkqzK1nRujQfC8CMuaOlHW9/HjC3S9 =Wb4P -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: First Virtual?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

Mark Terka writes: > Ok, so what are our options, given that this company seems to think > of security in terms of a plastic padlock. From corresponding posts > on the list, the only other alternative, Digicash, doesn't seem to > be too responsive to anyone's participation right now. It seems to me that DigiCash mistakenly 'jumped the gun' and announced before they were truly ready to test. This is such a common ocurrance in the computer industry that I'm suprised people are making noise over it. However, it indicates their reluctance to ship something before it's ready, which is good considering the technical and political challenges of the task they are undertaking. How can you really compare the proposed DigiCash systems versus FirstVirtual? One is a 'toy' system for moving credit card numbers around without actually broadcasting them in the clear, the other is a cryptographically secure digital cash type system. It's not suprising that FirstVirtual is ready sooner than DigiCash. However, assuming each system was ready and working as advertised, which would you trust for your financial transactions? With the possibility of millions and billions of dollars of commerce ocurring on the net in the near future, which do you think most people will want to use? While FirstVirtual may have it's place in the world of online payment systems, it is IMHO no replacement for a real digital cash system. The fact that most of the people who have even heard of these new payment systems are unaware of the not so subtle differences should alarm most cypherpunks. Digital cash isn't going to happen overnight (although most of us would like it to), and the last thing we want is for systems like FirstVirtual to become the de facto standard for online payment... andrew

3 2