December 2003 - cypherpunks-legacy

Re: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:10 AM 1/6/96, James Black wrote: >Hello, > >On Fri, 5 Jan 1996, Bruce Baugh wrote: > >> The problem is this: how can one spread the word that an old key is no >> longer to be used when one no longer has the pass phrase, and cannot >> therefore create a revocation certificate? > > If there is someone that you trust (or several people), just make a >revocation certificate and possibly cut it into pieces, and just let >those know when to send it out, so that you don't have to rely on a >faulty memory, and by having it in several hands they can't just send it >out, as they don't know the other people. Just a thought. If one can safely and securely store a revocation certificate for later use, why not just store the much shorter passphrase? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Internet & Porno on A&E tonite
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just saw an add for a Investigative Reports show tonite on A&E dealing with the Internet and some of the current issues relating to porno and privacy. Jim Choate

1 0

Re: Internet & Porno on A&E tonite
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 10:05 PM 1/6/96 GMT, Mutatis Mutantdis wrote: > >>Just saw an add for a Investigative Reports show tonite on A&E dealing with >>the Internet and some of the current issues relating to porno and privacy. > >What time?!? 9:00 P.M. E.S.T. ******************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; E-mail: | - Survive; lharrison(a)mhv.net | - Go to bed." *******************************************************

1 0

Mitnik: latest?
by Mark 17 Dec '03

17 Dec '03

I was curious where Kevin is now and what he is doing or waiting for? Anyone got a timeline of whats in store for him? Cheers, Mark

1 0

(cpx) Re: mental cryptography (fwd)
by David Vincenzetti 17 Dec '03

17 Dec '03

> I have read one paper which attempts to solve this problem, called "Human > Identification through Insecure Channel". Unfortunately my papers are in > a mess right now so I don't have the reference handy. It was by some > Japnese researchers, published in one of the proceedings books. I > believe a follow-on paper was published within the last year or two which > had some improvements or corrections to their algorithm. Sorry to be so > vague, I'll try to dig out more info over the weekend. > > Basically they used a challenge-response system which was intended to > be simple enough that people could do it in their heads. The card > would display a random challenge string, some characters of which were > special to the user and others which he would ignore. He would then > input a response string, where it didn't matter what corresponded to > the "ignore" slots, but in the special slots he had to produce certain > symbols corresponding to the other symbols, with the rules changing as > you move along. The intention was that even by capturing and analyzing a > great many challenge-response pairs you couldn't create a response to a > challenge you hadn't seen before. > > I coded this up, and frankly, I couldn't do the required manipulations in > my head, at least not without taking a very, very long time, and thinking > very carefully. Maybe it would get easier with practice, I don't know. > But my overall feeling was that this would be at the limits of human > capability even for fairly bright people. (OTOH I suppose learning to > read and write might seem pretty tough if you'd never done it. Maybe > the 1st grade classes of the future will spend months training the kids > on how to use these kinds of algorithms.) The paper can be found in the proceedings of Eurocrypt '91, D.W. Davies (Ed.), Springer-Verlag. The author is Hideki IMAI, <tsutomu(a)mlab.dnj.ynu.ac.jp>. I found the above paper very interesting, and I am actually going to code it up. Eventually, I would be highly interested in giving a glance at your code. Is your code available? Ciao, David

1 0

RE: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:47 AM 1/6/96, Frank O'Dwyer wrote: >On Saturday, January 06, 1996 09:18, Timothy C. May[SMTP:tcmay@got.net] wrote: >>Basically, you are screwed. Any revocation you attempt will not be trusted, >>as we will suspect the new "you" to be an attacker, perhaps an agent of the >>NSA or the Illuminati. In the view that "you are your key," the old you no >>longer exists. > >This is true, but the "old you" can be resurrected if you can get enough >people to believe your new key using any out-of-band means available >to you. You can also put a comment in your new key's uid explaining the Could you explain how "enough people" can get around a basic feature/limitation of the current PGP web of trust? Who, besides the originator, can revoke an old key? How many does it take? If a bunch of the "alleged" friends of Bruce could do this, could they not revoke the key of someone they simply wish to hassle? I agree that a new key can be generated, and a new "Please use this key, not the other one" message sent, and this may work, but I don't believe this revokes the old key and removes it from the keyservers. I could be wrong, as I am certainly no expert on the keyservers. The question is: is there a "majority vote" mode on the keyservers that causes them to remove a key if enough people claim it is no longer valid? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FW: Undeliverable: Re: Massey, CEO of Compuserve, on Internet
by blanc 17 Dec '03

17 Dec '03

From: Steve14571(a)aol.com Something else I want to know... Why is my mail going through microsoft.com? ....................................................................................................... There is an email 'alias' at Microsoft which was subscribed to the cpunk list, to receive and distribute the cpunk list to members of that alias. A new beta version of Exchange is being used on a test basis by some departments (apparently all of the cpunks at MS are using it), and the programmers recently encountered a "little complication" (to use a phrase from the movie 'Brazil'). I'm told that the problems were corrected, but that now the spoolers are releasing messages which were backed up while mail delivery was put on hold. I hate to agree with Timothy C. May, but it is probably best to "use technology " to deal with it for a day or so. .. Blanc

1 0

Why can't I get PGP from MIT
by post＠why.net 17 Dec '03

17 Dec '03

MIT won't let me get PGP or PGPhone. I know their server went down awhile back but, I have tried them several times and sent several e-mail requests. I thought maybe I was missing something obvious or maybe they are just really busy. I keep being told I'm not in the U.S. I have tried two different Internet service providers and my Unix account at Lockheed Martin Tactical Aircraft Systems. I understand why I would be denied when trying to get PGP from a commercial site but, under my personal accounts I get the same results. I requested that my providers be put on the "approved" list of domestic sites but still get the same results. My original e-mail request to MIT was sent roughly 3 months ago. All I want is clean copy of PGP for personal use. I have considered purchasing a commercial system but still would like to try PGP with the big keys. Thanks, Sid Post post(a)why.net

1 0

Re: Why can't I get PGP from MIT
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 1/6/96, post wrote: >MIT won't let me get PGP or PGPhone. I know their server >went down awhile back but, I have tried them several times >and sent several e-mail requests. I thought maybe I was >missing something obvious or maybe they are just really >busy. I keep being told I'm not in the U.S. As I recall, they don't tell you you're "not in the U.S.," they tell you they cannot conclude in the affirmative that you _are_ in the U.S. This has to do with whether they have a record (DNS) of your site, blah blah. And the message about sending them e-mail affirming your status, etc., points out that the mail is handled manually and may not be gotten to for a while. This happened to me, with PGPhone, when they could not confirm my ISP (got.net) to be a U.S.-based service. I simply grabbed one of the "otherwise available" copies (it was either posted publically, or available at an offshore site, I forget which). This was several months ago, the day after it was released. I fired it up, concluded I was missing some pieces needed to make it work, and put it aside for the time being. For PGP, I always go to the offshore sites anyway, on principle. These sites are listing with numbing frequency in all the usual places. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Revoking Old Lost Keys
by David E. Smith 17 Dec '03

17 Dec '03

At 11:11 AM 1/6/96 -0800, tcmay(a)got.net wrote: >If one can safely and securely store a revocation certificate for later >use, why not just store the much shorter passphrase? If the security of the safely-stored passphrase is violated, a lot of trouble can be caused. There's not nearly as much that can be done with a stored revocation certificate. dave --- Sorry for any delayed replies, but business trips are so seldom announced. David E. Smith, dsmith(a)midwest.net, PGP ID 0x92732139

1 0