December 2003 - cypherpunks-legacy

No Privacy Right in US ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Edupage, 28 November 1995, reports: ONLINE ANONYMITY IS ALL RELATIVE America Online has revealed the real name of a subscriber who called herself "Jenny TRR" to a Caribbean resort owner and dive instructor who claim they were defamed in remarks she posted on an AOL bulletin board. AOL gave the subscriber a chance to object to the action, but says she didn't attempt to fight the subpoena. AOL's assis- tant general counsel says the service doesn't disclose infor- mation about electronic mail, which is protected by the Elec- tronic Communications Privacy Act, unless it [ electronic mail ] is part of a criminal investigation. The item cites: Wall Street Journal 24 Nov 95 B1. There's two types of criminal investigations: those of crimes and those that are crimes. Cordially, Jim NOTE: To subscribe to Edupage send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Joe Louis (assuming that your name is Joe Louis; if it's not, substitute your own name).

1 0

Re: The future will be easy to use
by Rich Salz 17 Dec '03

17 Dec '03

>There is more to this problem than how it is that I trust the key. There >is also what I trust it for. ... >It is hard to see how to record the information about how much I trust the >receipent's systems security. Bingo! This is one of the hard parts of certificate authorities; just what are you attesting to? The American Bar Association has a big document for public review that addresses what this might mean; there are a couple of RFC's that specify CA policies (one from COST in Sweden, I think), and RSA and/or Verisign will give you their policy in hardcopy. In x.509v3 certificates, there is an extensible field where the key-signer can put arbitrary data. The intent is apparently that you put the ISO object-ID (you know, those funny 1.3.2.11.... numbers) of the policy document. There is, of course, no way to interpret the semantics of this electronically. It will be interesting to see how various companies address this issue, for example as they start to support arbitrary CA's in browsers or servers while doing commerce over the web. /r$

2 1

Re: Diskless "Eunuchs" Machines Likely to Fail
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: Timothy C. May \ Internet: (tcmay(a)got.net) TM> I'm skeptical of the "Diskless Internet Box = Telephone" analogy. TM> Folks I know who are not computer-savvy, or who have other things TM> they'd rather be doing, are not likely, as I see it, to buy boxes TM> that still require them to type messages to other people but that TM> don't allow them to download and save the interesting stuff they TM> find. TM> The telephone appealed to those who truly wanted to "just keep TM> talking"...that was the beauty of it. Most people don't know how to TM> touch-type, and typing by hunting-and-pecking is painful and unnatural TM> for most people. i guess it kinda depends upon the epoch in which you grow up. when telephones were first introduced, it didn't seem as natural to people as it does for us today. i've got a copy of the encyclopedia britanica published in 1903 that has some _facinating_ stuff on telecommunications. (i'm in the process of scanning it in. anyone who is interested in it can email me an i'll send it to you when i'm done. 1903=no copyright) i've seen people's typing skills improve remarkedly just through sheer repetition. i think that hunt-and-peck falls to look-and-peck if you find yourself typing to any serious degree rather quickly. TM> A couple of years ago "the computer for the rest of us" was said to be TM> a pen-based Newton-type machine, now it is said to be a diskless, TM> memory-limited "Eunuchs" machine. unless memory becomes _real cheap_ real fast, diskless workstations won't do. i don't see why it would be so hard for those pushing these machines to add enough disk to make it usable and still stay cheap. otoh, i don't think the internet is enough of a pull for people to want machines like this even if they did have local storage. i figure most people want computers to do something more for them than send e-mail. hell, i can send e-mail with a modem and dumb terminal. (been there-done that). i think the thing that will kill this idea will be the simple fact that people expect a computer to do more than what those pushing this 'technology' think they do. TM> I see a greater chance that home game machines, such as the 3DO and Sony TM> PlayStation machines will get Web browsers done for them than I do that TM> people will buy machines that are so limited. good call. i think people will soon be expecting more out of those game machinges than they currently do. i know i sure as hell would given the price. why can't current came machines support telecommunications? the modem i'm using to send this message is running on a dsp chip. i remember playing falcon-at via modem several years ago. it was a hoot even at the bauds available then. at 14.4 or better it would be a real hoot. TM> The only relevance of this whole topic to Cypherpunks TM> is....is....minimal. same here. however, what is happening in the computer business does have _some_ relevance to crypto as we have to see where the market is heading. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 29, 1995 18:18 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMLzqZ4dTfgZXlXydAQFxQgf9HY6aE53ZURtH10XrHlRggYrwK88WXtxf GmF1Vq8Gs7kwf3E71e8hDKCMJ6BDMTded2oYZjx1gmBMImxSczTX721IzbXttAKx H5Nm/hMAV85DdJhxexENY5Do9naf68YAklcloVr3UdTHI+KMeIbTKQdWp//s89Rx E02ohxyHIS/ckDRo89AMzVZWYv9dpP1Ua9VKAWM0uARtCITTDfM3ZvxRE7P7FYky xpnSHP2dobWWNIOl/4CUFmbYoOgi0nkWrEslisKJ67H/oL+8rkdts3qaKqIa/feV gqplKYmDB97diEjjuQCbqYUqGuwnSudrcpUnV4E9DkVOFALgdRC/aA== =9xHp -----END PGP SIGNATURE-----

1 0

Re: The future will be easy to use
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: Jack P. Starrantino \ Internet: (jps(a)monad.semcor.com) JS> I bring nothing cypher-wise. I would be willing to help walk the JS> s/w-engineering dog and to write Motif/X/socket if the chosen platform JS> is UN*X, however. JS> So, from an engineering standpoint, what should the "future" look JS> like? unfortunately, it appears to me that if you _really_ want encryption to be universal, it's gotta be done on windoze, it's gotta be point-n-click and seamless to the mail application. i would prefer it if the masses would use a real operating system, (no o/s wars please. i started in a mini/mainframe environment and simply don't think dos/windoze qualify your mileage may vary), but that just ain't the way it is. would netscape be selling at $130+ if they only wrote for unix? my 2 cents amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 29, 1995 17:40 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMLzhU4dTfgZXlXydAQEC1gf+ImAvGk2ceQqCt8E0EC9rlFwrMgEmgkZk E+mBd88dB8TazZn1n7oXasjc0GIjMZZCQYft9gqzuQDLQ6ceK5MpIZuREFWJq6+U nyvq/ivkiGwB4ubZ48xG4EJS8094C+Xj4fG/zgtNVsQr0O6ln/6Q/+bt/ciqP9PZ 4gjP4VYpmiFEQ3OGW/oYevmAxdvYYRoWEfjUwmG8tHKORWo9yfDs9yJHHYo3StmX SqM47v2F3D1r5JBgdrrIdOElwJHchU31kwk7trDs0/Ne7HWDdgIsX2MoDCW/Dwdt SaTC3B5TVpz6G/+FvxUSRWgY5vU1sqnCT5WogqTfJRP5ohz5rt6nqQ== =IB4/ -----END PGP SIGNATURE-----

1 0

Microsoft weak encryption
by Joel McNamara 17 Dec '03

17 Dec '03

Peter Gutmann has an interesting article in sci.crypt, demonstrating how weak Microsoft's encryption is with basic access control in Windows for Workgroups (I'm assuming Win95 uses the same algorithm). Essentially, he shows how a 32-bit key is created to be passed to RC4 for encrypting .PWL files. I think a t-shirt is definitely in order for this. Anyone up for writing some bruting code? Joel

4 3

Re: Encrypted Email
by James M. Cobb 17 Dec '03

17 Dec '03

Connie, On 11 27 95 you asked Can anybody briefly summarize for me some options for encrypting email that are secure? I know about PGP but I need something for (my environment) with an easy to use interface (PC-Windows) - for use by people who really aren't very computer literate. The following item from 11 27 95 Computerworld 58 may be helpful: CommTouch Software, Inc. in San Mateo, Calif., announced a secure Internet E-mail package called Pronto Secure. It allows connected and disconnected users to send and encrypt Internet mail. It supports many Internet security protocols, such as Power One-Time Pad, Pretty Good Privacy, Privacy Enhanced Mail, Secure Multipurpose Internet Mail Extensions (S / MIME) and MIME Object Security Services. Pronto Secure, which will ship in March, will require users to replace their existing Internet mail systems.... Comm- Touch plans to ship by mid-1996 a security module that is Messaging Application Programming Interface-compliant and works with a user's existing mail [system]. At p 66 of the same issue, there's a listing of "Recent in- formation security product announcements." CommTouch is listed there; its Internet address is micheleb(a)ipri.com and a single copy of Pronto Secure is US $299 list. ipri.com = InterActive Public Relations, Inc in 'Frisco. Cordially, Jim

1 0

WAY_lad
by John Young 17 Dec '03

17 Dec '03

11-29-95. FiTi: "Information highway needs rules of the road, says report." Pointing out the possibility of technical incompatibilities and trade friction if companies are treated differently in different markets, the report outlines the case for a "global regulator" within the structure of the new World Trade Organisation. It points out that issues such as intellectual property rights, encryption and government control on cross-ownership have global rather than national aspects. "Encryption, for example, raises tricky and emotive issues connected with organised crime and national security and cannot be treated simply as a business problem." No revolution for software [Editorial] Today's software market is the way it is not because of some evil conspiracy in Seattle, Microsoft's home town, but because it meets most consumers' interests most of the time. The power to set standards follows from that success. Changing technology widens the range of possible market structures, but does not affect customers' underlying needs and preferences. In the battle between the technologically possible and the economically attractive, economics always wins. WAY_lad (7 kb) FiTi on-line at <www.ft.com> for waylaying top article.

1 0

NOH_ide
by John Young 17 Dec '03

17 Dec '03

11-29-95. Washrag: "Postal Service Awards Contracts to Develop Computer Kiosks." The Postal Service predicted "more than 10,000" kiosks could be installed in post offices, libraries and shopping malls "within the next few years." The Postal Service is the lead government agency on the project, one of several administration initiatives designed to provide the public with computer access to government information. "CIA, Pentagon Back NIMA 'Concept' Combining Spy Satellite Photo Units." The Pentagon and the CIA announced an agreement yesterday endorsing the "concept" of consolidating eight defense and intelligence agencies -- those responsible for managing spy satellite photos and related tasks -- into a new National Imagery and Mapping Agency. NOH_ide (10 kb)

1 0

Re: key for Alice as promised (not)
by Adam Shostack 17 Dec '03

17 Dec '03

> > >Can you imagine?? I'm simply not willing to fool myself into thinking > > >that I ahve security by posting a key and using PGP. > > > > Unless you can post some proof that PGP is insecure, stop insisting it is. > > PGP is really not the issue. The issue is more my security and the > environment that I use PGP in. I don't have a trusted machine to run PGP > on. Anyone who wants to can come up to machine and copy my secret keyring > or they can even watch me typing my password in. Threat, please?? Do people often stand over your shoulder as you type? Enter your office, point guns at you, and take a backup of your entire computer? Have you considered putting the secret keyring on a floppy and locking it in your desk/safe when you're not actually in the office? (Or home..) > So, I don't fool myself, and I don't use PGP, except for things like > exchanging a one-time pad with someone when I've already sent the message > out across another delivery mechanism, like on a floppy delivered my > courier. I don't follow. You're claiming that PGP is good enough to transfer OTPads, but not good enough to sign pseudononymous messages? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: GOST for sale
by fluffy＠shout.net 17 Dec '03

17 Dec '03

What I wonder about is why anyone would use the Algorithm that the NSA is probably best at breaking. Breaking GOST was probably their number one project for years, and I would suspect that they have done it. chris

2 1