December 2003 - cypherpunks-legacy

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Clay Olbon II 17 Dec '03

17 Dec '03

On Mon, 3 Jun 1996, TT <apache(a)quux.apana.org.au> wrote: >I think it is actually easy to use, although granted others may not; but >that people tend not to use it as a matter of course (and it is my belief >this is a desireable thing) due too the time taken to manually sign mail >or sign and encrypt. Lets face it the average user has trouble with a >dos command prompt and until there is a point and click emailer easily >available most people just won't try PGP for email. Most people I have encountered don't use PGP because of the initial learning curve, more than the overall ease of use. I work in a small office that is separate from corporate HQ. I have been trying for over a year to convince people to use PGP for intra-office communication. What I have found is that for people within the office, it is fairly easy - hands-on instruction works well. Convincing folks at HQ has been a royal pain however. Most of the problem appears to be the "you mean I have to learn new software?" variety. Once I have coached someone over the "knowledge hump" (often by phone), they tell me that using pgp is pretty easy. <disclaimer> We use Eudora Light for the Mac, YMMV </disclaimer>. The trick is convincing the user that the benefits associated with using pgp are greater than the initial pain. This is something I have only accomplished with a few people. This educational process will continue to be the stumbling block for widespread use until there is truly seamless encryption. My fear is that seamless encryption will be weak; witness the widespread use of 40bit Netscape and the supposedly 40bit default behavior for S/MIME. I think that export controls are a driver towards weak defaults. OK, that last part was a WA tangent from my "ease of using pgp" thread. It's late and I'm hungry. Sue me. Later, Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

Re: Crypto APIs Considered Harmful
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:06 6/3/96, Timothy C. May wrote: >So long as ASCII (or Unicode, increasingly) message blocks can be handled >by a variety of editors, mailers, news programs, browsers, etc., it will be >impossible to stop users from using crypto on these blocks. I agree. But it really doesn't matter. The goal of the governments is not to stop people that are willing to operate a crypto program on blocks of text. That goal would be impossible to achieve. The goal of the governments is to ensure that once Joe Sixpack clicks "Encrypt Mail" in Netscape or MS Mail, the resulting cyphertext can still be read, though not by Joe himself. It is *because* PGP operated on blocks of text and did not provide a decent API that Joe (and even Tim May) are still not encrypting the bulk of their email. PGP isn't being used, because it lacks the API. S/MIME doesn't lack the API and is therefore being supported by all the major players. >But if crypto is tied to specific browsers, mailers, etc., this gives the >NSA and ITAR office a way to impose limits. Crypto should not be tied to specific browsers and mailers. Nor should it be tied to a specific program such as PGP. That's why hooks and APIs are crucial to gaining market acceptance. [...] >Obvious points. But in light of all the recent moves to limit deployment of >crypto by limiting the "crypto API" approaches, it's useful to remember >that for most applications, the message payload is perfectly suited for >carrying digital signatures, encrypted blocks, etc. > >They can't stop the messages, can they? Of course not. Nor do they want to. A little leakage around the edges is fine, as long as the masses don't adopt strong crypto. And that is a given, thanks to PGP's lack of modularity. I am not just slamming PGP. It is not the only CP "friendly" software that was implemented in an outdated, application-centric way. This was fine some four years ago, when people were still using DA/Font Mover to install fonts on their Mac, but it isn't today. Today's realities of software development and customer expectations require that secondary functionality (in this example, sending and receiving mail is the primary functionality) such as encryption, message encoding, etc. are completely transparent and fully integrate in the software that provides the primary functionality. How many of you are still using UUencode (the stand-alone program) when emailing someone a binary file? How many of you are using the "Attach File" button in your mailer? How many more people are sending binary files via email now that you can click "Attach File" than did back when you had to use UUencode? I rest my case. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:18 PM 6/3/96 -0400, Perry E. Metzger wrote: >Black Unicorn writes: >> There is a simple solution to avoiding liability. Don't trade in your >> own company's stock. > >In reality, of course, you are fairly safe so long as no one is >looking for your head and you aren't trading based on company >secrets. However, in theory, its possible to prosecute almost anyone. I hope insider trading never applies to the Company Stock Purchase plan or Stock Options. Otherwise they will kill the goose that lays Silicon Valley's golden egg. (I am always paranoid when the rules are vague and the penalties draconian.) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: NRC Session Hiss
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:58 6/3/96, Raph Levien wrote: > Basically, an exportable S/MIME client can transmit messages up to >1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit >RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually >restricted to 512/56 because of the keysize of DES). Note that the >asymmetry actually points in different directions for the public and >symmetric keysizes. What will be the maximum keysize for a domestic encryption client? It it is larger than 1024 bits, there will be interoperability problems with foreign clients. If the domestic client is limited to 1024 bits, it would set a bad precedence, since it would effectively require that the encryption key is smaller than the largest signature key. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:01 PM 6/3/96 -0400, Michael Froomkin wrote: >On Mon, 3 Jun 1996, Perry E. Metzger wrote: > >[...] >> Securities laws are extremely complex, extraordinarily broad, and >> subject to extremely flexible interpretation. I would suggest not >> attempting to skate a fine line near them -- the ice is very thin. > >Damn good advice, if you ask me. > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) However, it is becoming a deregulated industry. Like all the rest. DCF

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

Quoted text originated from tcmay(a)got.net -----BEGIN PGP SIGNED MESSAGE----- At 07.45 PM 6/1/96 -0700, you wrote: >Personally, I liked my "religious exemption" example. The Baal worshippers >can claim that they are engaging in their religion by grokking the >darkness. If picked up and held, they can claim they are "being held >without Baal." Isn't that a little far afield to go for a pun? :) >Most of the ordinances, including the one here, specifically state that >"blanket permission" by parents is not acceptable. They want _specific_ >reasons for being out after curfew. "To whom it may concern: My son, David Rosoff, is out of our house on this June 3, 1996, Monday night, to party with friends, cruise Central Avenue, and partake of the spores that grow of the earth. Signed, A. Parent" >(It's this taking control from both the kids and their parents and putting >it in the hands of cops that really bugs me.) "Me too." (Standard non-AOL disclaimer applies.) >By the way, if being out after curfew is breaking the law, can I make a >"citizen's arrest" of some of those nice young chicas in Watsonville? No comment. :) Really. - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNtGBguzHDTdpL5AQGK3QQAhX6CSiEr3z8puAhwDYlbayF7dBEUMtsk DygPCjL2lJ5d//WrEZxKm6ku/PoDDF9NcGqKBlHhuMYzCfEkOzdcv1idQ6lrWoua ONM3fdGSJt46qplX4UuSQSyLhKqvAwaijw7QDPCAedEFJsVVBPaDT1vpxDOFdylO UJBwLDjYa4k= =+KQb -----END PGP SIGNATURE-----

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10.23 AM 6/2/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >This, the curfew situation, is yet another of the reasons I'd favor "playing >hardball" with the government. I'm very much against discriminatory >enforcement, but on the other hand I don't think my liberty should be >dependent on getting an organization like the ACLU to look out for and >complain against discrimination against me. Are you then also in favor of killing, ruthlessly and brutally, not to mention somewhat randomly, both the police and the ACLU? - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNx2xguzHDTdpL5AQE6bgQAreE5ikGCKxsyjue0fEcKWtmmGU6o2WiU zTXD2Py8y395NVQFuSlrnWSJ4eKmIpePv1oZjgd7sE9wcpKjhHwHq2Fs/ZmsdEb2 CZxPY1qexpxolo0k8uFNbWvqxs/3ieOa0BzE7jmp0jyopejq2OjXheE1v3zGGKtt OBSb4vADydw= =X8Zs -----END PGP SIGNATURE-----

1 0

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Joel McNamara 17 Dec '03

17 Dec '03

Well for crypto-novices that use Windows, I'm hoping life will get a whole lot easier. I'm putting the finishing touches on the next release of Private Idaho (http://www.eskimo.com/~joelm/pi.html) Aside from some new "power-user" options (working with Lance to support a DOS version of Mixmaster), the next release is going to be targeted at all those folks who are intimidated by PGP. This includes features like an auto-install app, expert and novice modes, and a series of wizards for stepping the user through common tasks (I'm sure the name "wizards" is trademarked by MS, so they won't be called that). Also included will be something called PGP QuickStart. This utility will hand-hold a user through the entire process of downloading PGP from the Net, and installing and configuring it. I just wrote an essay for one of the on-line magazines on "unintentional crypto-elitism." One of my points was that decent crypto technology is now in place, and one of the next evolutionary steps towards wide-scale acceptance is implementing simple and easy user interfaces. Developers of public domain and commercial crypto apps really need to take this to heart. Joel BTW - I'm guessing Private Idaho version 2.7 will be available within the next two weeks. Send me e-mail (joelm(a)eskimo.com) with PI_LIST as the subject to get on the notification list (people on the list will be able to download about a week or so before it goes into wide-scale release).

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09.59 PM 6/1/96 -0400, Duncan Frissell <frissell(a)panix.com> wrote: >I'm afraid that some courts have explicitly held that "the child does not >have a right to liberty but only a right to custody." That is old law, >however. Kids have lost many rights recently too including gun rights, etc. I've known for a while that I have no rights as a minor. [ironic smilie] >Of course curfew laws only control the inarticulate and scruffy. Well >dressed children (coat and tie for the boys dress or suit for the girls) who I'll wear a suit if it means I won't get picked up ... :) >can claim that they are out doing tons of protected things like work and >school and worship and political campaigning and "trying to save street >children for Jesus" will not be picked up. They can also say things like >"Ossifer, I'm peaceably assembling to petition the government for redress of >grievances. It's in the First Amendment. You could read about it and >everything." You suggest that we minors stand up for ourselves? How odd. I'm sure no one has ever thought of that before, President Clinton especially. Since any nationally imposed curfew wouldn't have a leg to stand on in the first place, this can only improve the situation. >Home schooled children face this problem frequently and can usually find >something to say. Kids older than 15 or so can claim to be "emancipated >minors." Parents can emancipate their children by signing a simple >declaration to back up this claim. A good idea in any case. This sounds interesting. What are the particulars of being an emancipated minor? >"Whose children never got stopped by cops because at 14 they passed for 21. >Clothing and bearing alone can do it." I wish I were so lucky. At 15 I seem to pass for ... 12. I guess if the cops read from right to left ... - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNsyxguzHDTdpL5AQGvfwP/f2PDE5JPiczwY/5EFt/ziT9UePbcxCV0 UCbYdkbl9hoNlMphUu+O+zneGntCVOIiEoPZLTpK35TYFgA/MCOQhuiCYnvbInMo pZlmnTvyoUI1rkHTUzf2cHRg1+18ieJqDDqBqBb58ZxaLxxJ1crUDrL+QHC/QZE9 mAiLT9tnwgc= =/+GV -----END PGP SIGNATURE-----

1 0

No Subject
by qut＠netcom.com 17 Dec '03

17 Dec '03

list cypherpunks

1 0