December 2003 - cypherpunks-legacy

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Clay Olbon II 17 Dec '03

17 Dec '03

On Mon, 3 Jun 1996, TT <apache(a)quux.apana.org.au> wrote: >I think it is actually easy to use, although granted others may not; but >that people tend not to use it as a matter of course (and it is my belief >this is a desireable thing) due too the time taken to manually sign mail >or sign and encrypt. Lets face it the average user has trouble with a >dos command prompt and until there is a point and click emailer easily >available most people just won't try PGP for email. Most people I have encountered don't use PGP because of the initial learning curve, more than the overall ease of use. I work in a small office that is separate from corporate HQ. I have been trying for over a year to convince people to use PGP for intra-office communication. What I have found is that for people within the office, it is fairly easy - hands-on instruction works well. Convincing folks at HQ has been a royal pain however. Most of the problem appears to be the "you mean I have to learn new software?" variety. Once I have coached someone over the "knowledge hump" (often by phone), they tell me that using pgp is pretty easy. <disclaimer> We use Eudora Light for the Mac, YMMV </disclaimer>. The trick is convincing the user that the benefits associated with using pgp are greater than the initial pain. This is something I have only accomplished with a few people. This educational process will continue to be the stumbling block for widespread use until there is truly seamless encryption. My fear is that seamless encryption will be weak; witness the widespread use of 40bit Netscape and the supposedly 40bit default behavior for S/MIME. I think that export controls are a driver towards weak defaults. OK, that last part was a WA tangent from my "ease of using pgp" thread. It's late and I'm hungry. Sue me. Later, Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 2 Jun 96 at 21:15, Lucky Green wrote: > That PGP is ubiquitous is subject to discussion. PGP is widely available, > but that doesn't mean that it is widely used. What percentage of email is > PGP encrypted? Less than half a percent? In part because it's not well integrated with mailers. That could change with a PGP3 DLL. PGP isn't only used for email: o files distributed over the net that are PGP-signed o signed email o non-emailed file distributions (over BBS, or physical transfer of disks) o personal storage (though other utilities are better-suited for that than PGP) o related utilities that make use of PGP-keys (HPack archiver) The reasons PGP hasn't become widely used are because of it's lack of user-friendliness and poor integration into other tools, irregardless of S/MIME. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 2

Re: Crypto APIs Considered Harmful
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:06 6/3/96, Timothy C. May wrote: >So long as ASCII (or Unicode, increasingly) message blocks can be handled >by a variety of editors, mailers, news programs, browsers, etc., it will be >impossible to stop users from using crypto on these blocks. I agree. But it really doesn't matter. The goal of the governments is not to stop people that are willing to operate a crypto program on blocks of text. That goal would be impossible to achieve. The goal of the governments is to ensure that once Joe Sixpack clicks "Encrypt Mail" in Netscape or MS Mail, the resulting cyphertext can still be read, though not by Joe himself. It is *because* PGP operated on blocks of text and did not provide a decent API that Joe (and even Tim May) are still not encrypting the bulk of their email. PGP isn't being used, because it lacks the API. S/MIME doesn't lack the API and is therefore being supported by all the major players. >But if crypto is tied to specific browsers, mailers, etc., this gives the >NSA and ITAR office a way to impose limits. Crypto should not be tied to specific browsers and mailers. Nor should it be tied to a specific program such as PGP. That's why hooks and APIs are crucial to gaining market acceptance. [...] >Obvious points. But in light of all the recent moves to limit deployment of >crypto by limiting the "crypto API" approaches, it's useful to remember >that for most applications, the message payload is perfectly suited for >carrying digital signatures, encrypted blocks, etc. > >They can't stop the messages, can they? Of course not. Nor do they want to. A little leakage around the edges is fine, as long as the masses don't adopt strong crypto. And that is a given, thanks to PGP's lack of modularity. I am not just slamming PGP. It is not the only CP "friendly" software that was implemented in an outdated, application-centric way. This was fine some four years ago, when people were still using DA/Font Mover to install fonts on their Mac, but it isn't today. Today's realities of software development and customer expectations require that secondary functionality (in this example, sending and receiving mail is the primary functionality) such as encryption, message encoding, etc. are completely transparent and fully integrate in the software that provides the primary functionality. How many of you are still using UUencode (the stand-alone program) when emailing someone a binary file? How many of you are using the "Attach File" button in your mailer? How many more people are sending binary files via email now that you can click "Attach File" than did back when you had to use UUencode? I rest my case. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:18 PM 6/3/96 -0400, Perry E. Metzger wrote: >Black Unicorn writes: >> There is a simple solution to avoiding liability. Don't trade in your >> own company's stock. > >In reality, of course, you are fairly safe so long as no one is >looking for your head and you aren't trading based on company >secrets. However, in theory, its possible to prosecute almost anyone. I hope insider trading never applies to the Company Stock Purchase plan or Stock Options. Otherwise they will kill the goose that lays Silicon Valley's golden egg. (I am always paranoid when the rules are vague and the penalties draconian.) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: NRC Session Hiss
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:58 6/3/96, Raph Levien wrote: > Basically, an exportable S/MIME client can transmit messages up to >1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit >RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually >restricted to 512/56 because of the keysize of DES). Note that the >asymmetry actually points in different directions for the public and >symmetric keysizes. What will be the maximum keysize for a domestic encryption client? It it is larger than 1024 bits, there will be interoperability problems with foreign clients. If the domestic client is limited to 1024 bits, it would set a bad precedence, since it would effectively require that the encryption key is smaller than the largest signature key. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:23 AM 6/3/96 -0400, Perry E. Metzger wrote: >No, I'm afraid they aren't. Under the rules, if you have nonpublic >information, even if you are not a corporate officer, you are an >insider for purposes of "insider trading" and your trades are illegal. Though if I trade based on my non public knowledge that the Gray Aliens will strike at Midnight on 31 December 1999, I am probably safe. Doesn't the non-public knowledge have to have been generated or concern internal company information (or the intentions of a publisher or buyer concerning the company). If info that is too far removed is included then any stock analysis system would be illegal. Note BTW that the Feds lost almost all of the '80s insider trading cases that actually went to trial. They only won 2 or 3 that went through the full trial and appeals process. That is a very poor record since prosecutors usually have an 80-90% success rate in criminal trials. >Securities laws are extremely complex, extraordinarily broad, and >subject to extremely flexible interpretation. I would suggest not >attempting to skate a fine line near them -- the ice is very thin. And like most federal criminal procedures based more on hype than reality. One should emulate the head of Princeton Securities who showed up for settlement negotiations with the Feds wearing a "Shit Happens" baseball cap. All charges dismissed on appeal. I do think though that many actual "inside traders" are pretty dumb since it is not hard to trade securities anonymously. DCF

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:01 PM 6/3/96 -0400, Michael Froomkin wrote: >On Mon, 3 Jun 1996, Perry E. Metzger wrote: > >[...] >> Securities laws are extremely complex, extraordinarily broad, and >> subject to extremely flexible interpretation. I would suggest not >> attempting to skate a fine line near them -- the ice is very thin. > >Damn good advice, if you ask me. > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) However, it is becoming a deregulated industry. Like all the rest. DCF

1 0

Re: Java Crypto API questions
by br＠doppio.Eng.Sun.COM 17 Dec '03

17 Dec '03

Martin Minow (minow(a)apple.com) writes: [...] |-- Policies = Assertions + Capabilities. That's what my notes Policies are statements like: "code endorsed by any one of the following signatures (say three of my friends) can access the public part of my file system" This is hard. It's probably not going to make it in the first release. The simple first pass is to say "code signed by x, y, and z" can do whatever it wants. |-- Feedback to security-api(a)java.sun.com. The alias had some trouble over the week-end. It should be working fine now. -- Benjamin

3 2

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

Quoted text originated from tcmay(a)got.net -----BEGIN PGP SIGNED MESSAGE----- At 07.45 PM 6/1/96 -0700, you wrote: >Personally, I liked my "religious exemption" example. The Baal worshippers >can claim that they are engaging in their religion by grokking the >darkness. If picked up and held, they can claim they are "being held >without Baal." Isn't that a little far afield to go for a pun? :) >Most of the ordinances, including the one here, specifically state that >"blanket permission" by parents is not acceptable. They want _specific_ >reasons for being out after curfew. "To whom it may concern: My son, David Rosoff, is out of our house on this June 3, 1996, Monday night, to party with friends, cruise Central Avenue, and partake of the spores that grow of the earth. Signed, A. Parent" >(It's this taking control from both the kids and their parents and putting >it in the hands of cops that really bugs me.) "Me too." (Standard non-AOL disclaimer applies.) >By the way, if being out after curfew is breaking the law, can I make a >"citizen's arrest" of some of those nice young chicas in Watsonville? No comment. :) Really. - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNtGBguzHDTdpL5AQGK3QQAhX6CSiEr3z8puAhwDYlbayF7dBEUMtsk DygPCjL2lJ5d//WrEZxKm6ku/PoDDF9NcGqKBlHhuMYzCfEkOzdcv1idQ6lrWoua ONM3fdGSJt46qplX4UuSQSyLhKqvAwaijw7QDPCAedEFJsVVBPaDT1vpxDOFdylO UJBwLDjYa4k= =+KQb -----END PGP SIGNATURE-----

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10.23 AM 6/2/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >This, the curfew situation, is yet another of the reasons I'd favor "playing >hardball" with the government. I'm very much against discriminatory >enforcement, but on the other hand I don't think my liberty should be >dependent on getting an organization like the ACLU to look out for and >complain against discrimination against me. Are you then also in favor of killing, ruthlessly and brutally, not to mention somewhat randomly, both the police and the ACLU? - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNx2xguzHDTdpL5AQE6bgQAreE5ikGCKxsyjue0fEcKWtmmGU6o2WiU zTXD2Py8y395NVQFuSlrnWSJ4eKmIpePv1oZjgd7sE9wcpKjhHwHq2Fs/ZmsdEb2 CZxPY1qexpxolo0k8uFNbWvqxs/3ieOa0BzE7jmp0jyopejq2OjXheE1v3zGGKtt OBSb4vADydw= =X8Zs -----END PGP SIGNATURE-----

1 0