December 2003 - cypherpunks-legacy

Jeff @ViaCrypt
by Joe Turner 17 Dec '03

17 Dec '03

Please excuse the bandwith. Earlier today I had a conversation with Jeff who claimed to be from ViaCrypt. I was in a hurry to attend a lunch/meeting and forgot to get his internet address. Could someone point me in the right direction? -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597

1 0

PGP hook for Eudora?
by dmandl＠bear.com 17 Dec '03

17 Dec '03

> Jonathan Rochkind wrote: > > > Because premail makes it incredibly easy to use PGP on a unix box. And, for > > that matter, the Eudora/PGP applescritps make it incredibly easy to use PGP > > on a mac. And there are some people working on an applescript that will I keep hearing about PGP hooks for (Mac) Eudora, but a casual search of at least five advertised ftp sites has turned up nothing. Can someone post an address where this stuff can definitely be found? Thanks. --Dave.

2 1

CFV on Signing Posts To List?
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It seems like we have a pretty good thread on the for/against arguments re: digitally signing articles posted to the list. Perhaps we should allow it to run its course over the next 48 hrs, and then Eric could circulate a form like the following Friday morning (ie Dec 2): - --------------------------------------------------------------------------- Question: Do you agree that all articles posted to the list should be digitally signed and that the keeper of the list should take steps to implement such? Yes ___ No ___ - ---------------------------------------------------------------------------- I realize we are not exactly in a democracy here (ie Eric maintains the list) but then again the participation of the subscribers would be a lot more enthusiastic if the perception of "majority rules" was met. As someone mentioned earlier, this discussion seems to pop up every so often and ramble on for a certain amount of time with nothing being resolved. Maybe a "Call for the Vote" would change that. We all would seem to hold the net and its functions to a high degree of importance. Settling of this issue (as opposed to the thread meandering for the next month or so) would indicate that something concrete in favour of crypto could be implemented (or discarded....after suitable discussion) by its main proponents. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtu4hK+YbMzawbu5AQE4GAP+LM4gNXDS5O4uzOWTYC4U60veXnjWVjC6 gXxvE/fEJu99SzThgthrf51Jb5K4hKrtJfZ44hwmdyQHsOx+p9xStjkSZFQFWc7b /J9vEtzwG/IyO/DxD2hHmCzUod64WIx0cXtwUDjUCxgDnAdFaIEjhLfYk5Pr3KaW e6mkrDiQtSQ= =S4BI -----END PGP SIGNATURE-----

2 1

(re-tx) RE: Transparent Email (WAS disable telnet to port 25)
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

I sent this yesterday, but it apparently didn't through. -- > > I don't have an answer to your question, but you did bring up something > > I've been meaning to ask about for some time and I never really got > > around to it; Are there any short-term plans to press for an RFC > > utilizing digital signatures? With the exponential increase of mail Existing standards track RFCs support PEM-based security of RFC-822 email (RFC 1421, RFC 1422, RFC 1423, and RFC 1424). Recent work on security of MIME has allowed for an alternative content protection and certification mechanism (i.e. PGP). See Internet Drafts draft-ietf-pem-sigenc-02.txt and draft-ietf-pem-mime-07.txt which respectively define the framework and the PEM-specific parts. > The best answer that I can come up with for this problem is to allow for > several webs of trust to function simultaneously. Perhaps we would have The intent of the MIME extensions is to enable either PGP or PEM to be used, although the standard for the former is I believe still pending. I am not aware of efforts to integrate the two certification mechanisms. > A web could be defined by a single top-level public key and a set of This is the function for the IPRA (as discussed in RFC 1422). > rules. Perhaps a text based program -- a sort of "meta-pgp" -- could > check chains of signatures to validate a key. This is what a PEM-conformant user agent does. > Suppose, for example, that I'm administering a web of trust. I set up > the web so that I can deputize notaries who can in turn sign user keys. The PEM WG used to call these organisational notaries, but they have been dropped from the standards. They are also referred to in related work as Local Registration Agents or Authorities - and are necessary for large organisations' use of certification services. > Lets further assume that all signatures are good for a year. A keyserver > would return a text file containing: (a) the user's key, concated with a > notary's key, concated with a header specifiying the date it was singed > by me. This sounds similar to the certification message in RFC 1424. There isn't a requirement for certificate retrieval as certificates are sent with the message or handled using (as yet unspecified) directory facilities - probably an extended DNS in the Internet environment. - pvm

1 0

signing messages
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Seems like one way to encourage the use of digital signatures is to start forging messages from people who don't ordinarily sign their messages. Necessity is the mother of invention, and all of that. I finally started signing my messages on a regular basis as a result of Detweiler forging a message which purported to be from me. On the other hand, I think Tim has been the most frequent target of Detweiler's forgeries, and I don't detect much of a creep towards signing messages on his part. Eric, would you mind clarifying the purpose of the "sign-or-delay" rule? Last time this came up I assumed that it was to encourage folks who had 95% of the tools/initiative to start using crypto techniques on a day-to-day basis to get off their asses and do so; but other people seem to have different ideas about the purpose(s) of such a practice. I think it might be interesting to try the "sign-or-delay" rule on a part-time basis - perhaps weekends only, or never on weekends, or only during December, or whatever. To me, it seems useful as sort of a "Great American Smoke-Out Day" for crypto; to get folks to go just one day where they use crypto in a practical, applied way, to prove that they can do it. What they do after that is their own business. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtvFC33YhjZY3fMNAQGc+QP/R2kBRlCNVLDVJNOLOGOWv6URYmnj+qTt poo1LKtz31Mzj+rBAiXPZSYY5xPtTXKD/7X8dU3JYyJbH12kwvH/RS1GS4mEV++V QDJD6L84EekrdFy0piP7jsGDMq2SQsHnI6G3GG0koGoMN/3u/UbDiCG3+yJ1b5u1 iMCS8dZQTfA= =eCnh -----END PGP SIGNATURE-----

4 3

RE: CFV on Signing Posts To List?
by Blanc Weber 17 Dec '03

17 Dec '03

I disagree that a cypherpunk should be expected agree to commit everyone towards arriving at a consensus over whether anyone who posts to the list should sign their messages, or that the list owner should be expected to submit to their conclusions simply because that is what they agreed among themselves he ought do. It's a matter of (anarchist) principle. Blanc

1 0

Mandatory message signing
by Tom Bryce 17 Dec '03

17 Dec '03

>It's usually a good idea to read for at least a month before leaping >into the discussion, so as not to overreact. I guess so. :) > > I thought the whole grassroots crypto thing was about protecting privacy > > rights and individual liberty and all that. So what if someone wants to > > post a message to cypherpunks AND DOES NOT WANT ANYONE TO BE ABLE TO > > PROVE THEY WROTE THE MESSAGE. > >Mechanisms for this already exist. For example, register a PGP key to >a pseudonym, such as "Dr. Death". >An advantage of doing this is that even though no one really knows who >"Dr. Death" is, you can sign messages certifying that yes, the person >they know as "Dr. Death" wrote this message. Without this >certification, anyone can claim to be "Dr. Death" at any given moment. Hmmm. But even with a psuedonym like that, people can still claim you were Dr. Death, and Dr. Death will have posted enough stuff about enough things so the Dr. and you can be linked fairly certainly, isn't this right? There's a reason why one should prefer the telephone over mail for many matters. That is, no one can record your call (legally) and prove that you said a certain thing at a certain time, while they can keep your letter and prove you wrote a certain thing. Honestly, the chance of someone posting a fraudulent message under someone else's email address to the cypherpunks list is pretty slim, but that possibility (or the chance that they left their computer on and someone sent something, etc.) leaves you plausible deniability if you ever want it. If one has to sign all their posts with their pgp key, or conversely with a psuedonym generated for the purpose, to me, that's beginning a dangerous practice of using the technology to invade peoples' privacy instead of expand their privacy possibilities. People who want a psuedonym identity and who want their messages to be verified against a PGP signature can easily choose to do so, presently, and if you wanted to, you could append a notice to the end of an unsigned message: NOTE: The preceding message was not accompanied by a digital signature, and its authenticity may be suspect. But I guess I just don't see why people should have to sign their messages under some given key to contribute to the group. Unless you generated and registered a new key for every message you wanted to post, there would still be unforgeable evidence linking you or your psuedonym to a series of posts. And if there was a series of posts from your psuedonym, that increases the chances it could be linked to you. And besides that, you might want to post free and clear and sign your name to it, and forget the hiding behind a psuedonym stuff. Just you don't want to sign the message digitally. This seems like a perfectly valid choice that users should have the privacy rights and freedom to make. Tom

2 1

Premail and transparent email
by raph＠netcom.com 17 Dec '03

17 Dec '03

It's quite gratifying to see that people are actually using premail and like it. I see premail as a prototype for _real_ transparent email encryption. A lot of people are intimidated by the need to get premail off the ftp site, unzip/untar it, and set all the configuration variables to get it running right. This "intimidation factor," of course, only applies to *x people. Everybody else is completely out of luck. I think the same problems hold with most of the scripts that are out there. Every time I've gotten something to play with, I've had to diddle with pathnames, or the makefile, or whatever. The real solution, I think, is to get all the needed components for transparent email encryption into the standard releases of the tools. I'm currently working on exactly this project. In rough outline, PGP will run as a "server" process. Mailers would connect to the server, and pass all incoming and outgoing mail through it. One advantage is that clients would contain _no_ crypto content, so there would be no problems with exportability. The server would contain much of the functionality of premail. I showed an early prototype at the last cpunks meeting. Initially, I am doing all the work in *x, just because that's what I have tools for, but ultimately it should work for Windows and Mac as well. My intent is to get large numbers of people to use PGP to encrypt all of their email, including casual stuff. This won't happen until encryption and decryption are _totally_ transparent. -- Raph Levien -- raph(a)netcom.com

2 1

premail 0.30
by Michael K. Sanders 17 Dec '03

17 Dec '03

I've got premail v0.30 installed here as /usr/lib/sendmail. I added the $config{"sendmail"}="real_sendmail" option, but this means that ~/.premailrc is not used. But that users can't specify their own options... Specifically, it looks as if doing it this way I can't automatically PGP sign my mail without adding it to the global script, but that would mean _all_ mail out of this site would be signed with my id. Any suggestions how to go about this? It makes it so convenient to have it replace sendmail, but I'd like to sign my mail as well. -- Michael K. Sanders -- msanders(a)ataxia.res.wpi.edu ataxia: NetBSD/Amiga 1.0 - Creating Chaos out of Anarchy for a Better Tomorrow Ataxia Home Page

2 2

Re: The Market for Crypto--A Curmudgeon's View (fwd)
by Jonathon Fletcher 17 Dec '03

17 Dec '03

On Tue, 29 Nov 1994, Sandy Sandfort wrote: [ ... stuff r'moved ... ] > > Personally, I'm against mandatory digitally signatures as a > rerequisite for posting to Cypherpunks. On the other hand, I > like the idea of having the list software automatic verify > digital signatures. This is a valuable service I'm usually too > lazy to perform for myself. > > Here's my suggestion. Eric should unilaterally impose his first > step, i.e., all unsigned messages and messages with spoofed > signatures will henceforth be flagged as such. Let's see what > effect, if any, that has on the way people post their messages. > After the protocol has been in effect for some time, we can > re-open the topic for further discussion. > This is a good idea - certainly a nice way to emphasize (sp) signing posts. Having majordomo verify signatures automatically and add message content if either (as sandy suggests) signature is missing or bad. One question would be whether majordomo should add content upon verification of a signature, or upon failure to verify a signature (missing or bad). Depends on which would have most 'positive' appearance, and (more importantly) would generate least extra volume in the long term. Personally I think that flagging the messages with bad or missing signatures is a better idea - as more people sign articles on the list there will be less flagging volume sent out by md. Nice idea Sandy. ... only snag is that md has to be modified again. Has Eric the time and desire to fit this in. I can't help with the perl - still not grokked it properly. -Jon -- Jonathon Fletcher j.fletcher(a)stirling.ac.uk " .. all opinions expressed or implied are my own and not necessarily those of my employer or any other party ... "

1 0