December 2003 - cypherpunks-legacy

Re: Lack of PGP signatures
by Brad Shantz 17 Dec '03

17 Dec '03

Mark M. Wrote: > > Is it because most mail programs are not PGP aware? > > I don't know of any mail programs that can use PGP (I know there are various > interfaces, sendmail wrappers, and other hacks, but I have yet to see a mailer > with an "Encrypt" or "Sign" option. Once upon a time last year or the year before, Tim May posted why he doesn't use PGP very often. And I have always stood by that same sentiment. Yes, it is a good encryption product, but it is not integrated seamlessly into other applications. Tim, feel free to whack me if you think I'm speaking for you. If, as cypherpunks, we want to spread the use of strong crypto, we need to have a better interface than what currently exists on PGP 2.6.2. I'm sure Derek and the other guys on PGPlib will make it easier to integrate into applications. Am I just blowing smoke, Mr. Atkins? PGP is a pain for encrypting or signing e-mail when you have to save your message out to a temp file, encrypt it, and load it back in to your mail package. Sure, there are things like Private Idaho, which I use on occasion. But, it is still a seperate application that just doesn't fit seamlessly into most applications. In my free time, I have been playing around with add ons for Microsoft Exchange. I've got an OLE 2.0 encryption object that embeds nicely into an Exchange message. I haven't tied it in to PGP yet, because I have been waiting for the release of PGPlib. However, that will allow at least some seamless integration. Brad Shantz TRIsource Windows Development Services

4 3

Re: SAFE Forum--some comments
by minow＠apple.com 17 Dec '03

17 Dec '03

Jim Bell asks about Macintosh exportability. There appears to be no problem using a non-tappable authentication in the AppleShare client (but this does not mean that the actual data is secure). The PowerTalk module (available with System 7.5 and later, but to be replaced in the future for reasons not having to do with crypto) supports additional crypto-related functions, including MD5, RSA digital signatures and 40-bit encrypted (and, hence, exportable) data streams. Apple did negotiate with the export control people in order to fashion a technology that could be exported. There are also country-specific kits in order to meet import requirements. The actual strong encryption capabilities are not accessable to developers or end users. MD5 and RSA signing API's are published and, as part of my work at Apple, I wrote and distributed sample code that shows how to use them to sign and verify arbitrary data areas. At the poorly-attended June physical c-punks meeting in Palo Alto, I gave a very brief overview of Apple's "crypto-related" capabilities and could repeat it at a future meeting. > >I haven't bought a new VCR in a few years. Is this real? What prevented >them from doing this 10 years ago? > This is fairly recent. It requires a cooperating (generally, PBS) station that broadcasts the timecode in one of the retrace lines. Martin. minow(a)apple.com

1 0

Re: Lack of PGP signatures
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:38 AM 7/3/96, Brad Shantz wrote: >Once upon a time last year or the year before, Tim May posted why he >doesn't use PGP very often. And I have always stood by that same >sentiment. Yes, it is a good encryption product, but it is not >integrated seamlessly into other applications. Tim, feel free to >whack me if you think I'm speaking for you. If, as cypherpunks, we >want to spread the use of strong crypto, we need to have a better >interface than what currently exists on PGP 2.6.2. You are correct in your memory of what I said. My message is somewhere in the archives...but the archives are of course no longer very available. I'll make a few brief points: 1. PGP and other crypto tools are not well-integrated into Eudora, Microsoft Mail, cc:Mail (or whatever), Netscape mail, etc. Sure, various tools exist, but not out-of-the-box. (Proof that crypto confusion has been a successful strategy for U.S. authorities.) 2. For me, using PGP means using MacPGP. This means cutting-and-pasting and extra work. (Given that I often delete messages after only glancing at them for 5 seconds or less, any additional work is not welcome.) 3. Of course, I will only _decrypt_ messages sent to me personally, for obvious reasons. And given that I am very open about my political views and am neither a money launderer nor a conspirator, nor a Horsemen of any other flavor, most of the PGP-encrypted messages sent to me are banal and PGP use was unneeded. (After doing the mumbo jumbo to decrypt a message, I get crap like "Yo, Tim, just wanted to say that PGP is, like, really kewl. Send me some encrypted stuff.") And so on. I use PGP when I think it is necessary. As to using it _routinely_, at least signing routinely and checking signatures routinely, it can't be routine until it is routine. Why isn't mail in the major e-mail packages _automatically_ signed? Look to them for answers. Look to the NSA for more answers. Look to Dorothy Denning for an explanation of why obstacles need to be placed in the path of wider use of crypto. (Note to Mac users: before any of you wastes your time composing a message to me about a new package that makes links to MacPGP through AppleEvents, it turns out that one has to first install a tool that is only commercially available, for $$$. Again, obstacles have been placed in the path of easy and wide use of crypto.) Finally, a comment. I've never really bought the argument that we should all be using PGP in all of our messages to set some kind of example or to provide cover traffic. We don't have to set any kind of example, in my cosmology. And the "cover traffic" is amply provided by an exponential increase in Web traffic, alternate routes, new services, etc. I think crypto tools need to be made easier to use (without installing additional commercial tools which cost more than the mail package itself), but until then I will feel no guilt about not using PGP more than I do. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Sameer on C-SPAN
by bluebreeze＠nym.jpunix.com 17 Dec '03

17 Dec '03

:bluebreeze@nym.jpunix.com (Blue Breeze) wrote: :> :> Not everything. No picture of Sameer!? That's what I'd like to see. : :There's one in the latest WebSmith magazine. Thanks Matt. Outta my way! (Thanks to Alan too.)

1 0

Re: Message pools _are_ in use today!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 AM 7/3/96, David Wagner wrote: >Jim Bell brought up the really nifty point that someday soon we may be >able to receive these message pools by satellite dish-- hurray for true >broadcasting! That would provide most excellent security (unless `they' >started requiring licenses, waiting periods, ... to own a dish-- unlikely). >I can't wait. Yeah, and I should have mentioned the "PageSat" Usenet distribution model, too. (It was a really hot topic 3-4 years ago, but I've heard little of it in the past couple of years...the rise of the Web has made passive downloads of Usenet a lot less interesting.) Someone mentioned the Ku-band dishes that are used by PageSat (or whatever it is now called....). My DSS system, which is technically a Ku-band receiver, has a digital i/o connector of some sort on the back, and it is rumored that this will someday be available for PageSat-like uses. (I have a feeling this may be years off, for admin reasons if not technical reasons.) The point being that there are already _many_ ways to read NetNews almost untraceably. With more to come. (NetNews also used to be available on CD-ROM; the volume is now so high that this just isn't practical anymore. But it underscores the point that NetNews is so "distributed" that attempts to track who is reading "alt.anonymous.messages," and _particular_ messages in such a group, are nearly hopeless.) Finally, the threat model has two angles to consider: 1. The authorities want to know all those who have read a particular message--call it "ToAlice" to keep in the "Alice" and "Bob" framework. 2. The authorities already have identified a suspect, call him "Bob," and wish to know if he reading (and perhaps decrypting) messages to "Alice." As several of us have noted, #1 is tough--real tough. The authorities would have to contact 10,000 or more ISPs who have local newsfeeds and subpoena their logs of who read which newsgroups...assuming such logs are even kept (I don't know the granularity of such logs, whether any logs are kept of specific newsgroups and specific messages within newsgroups). The authorities would have to also check on the other distribution "vectors," including _subscriptions_ to NetNews newsgroups (where a newsgroup is _mailed_ to recipients...I heard this is an option for some). And PageSat, and so on. The second angle, #2, is formally equivalent to wiretapping a target. Once identified, and tapped, anything the target reads can presumably be read by the authorities. (Quibbles: I really mean a "black bag" type of surveillance, where the target's local machine has been compromised/tapped.) The bottom line is this: were I an FBI agent given the task of finding out who is reading a specific message or series of messages, e.g., the "ToAlice" encrypted messages posted in alt.anonymous.messages, I would tell my bosses it is economically impractical. --Tim May (P.S. I think this recent discussion of message pools, started by Hal and continued by this latest thread, is very important. Message pools have fewer of the kinds of "correlations" that can allow sender-recipient correlations to be made.) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Lack of PGP signatures
by nowhere＠alpha.c2.org 17 Dec '03

17 Dec '03

At 09:42 PM 7/2/96 EDT, Derek Atkins <warlord(a)MIT.EDU> wrote: :Basically, I refuse to type my passphrase over the net, which signing :all my messages (this one included) would require. : :-derek Why, in heaven's name, would you have to "type your passphrase over the net" to encypher a message?

2 1

Re: Ken Bass: Wire tap only useful for conviction (Was: SAFE Forum--some comments)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 09:59 AM 7/3/96 -0400, Michael Froomkin wrote: >...wiretaps help LEOs identify co-conspirators. They are >not without intelligence value. True, but so do pen registers. It's usually easy enough to separate calls to Pizza Hut from calls to co-cospirators. There is no need to hear the content of a call to get a good idea who is involved in a conspiracy. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: But what about the poor?
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09.29 PM 7/2/96 -0800, jim bell wrote: >At 10:16 PM 7/2/96 -0500, snow wrote: >>On Tue, 2 Jul 1996, jim bell wrote: >>> stated policy of the escrow agent is that the key owner MUST be informed, >>> what are the cops gonna do about it? >>> >>> Further, how are the cops going to evidence the existence of a valid >>> warrant? (As opposed to a forgery?) >> >> The judge that issues it will digitally sign it. You can check the >>signature block. > > >However, what about an UNCOOPERATIVE escrow agent? (one who insists on >signed paper, or for that matter insists that the judge himself shows up.) >Or one, at least, who sites himself in Borneo, on the top of a 4000 foot >mountain, with a 386 laptop computer and a box of floppies, and who promises >2 hour services to anybody who shows up? No email, no fax, no phone, no >light, no motor car, not a single luxury....oooops....sorry about that...not >even radio. > >Moreover, if the escrow agent is out of the country, can any domestic laws >force him to divulge keys? And anyway, you could just be a kind of escrow agent that will hold the keys for the key owner, right? You don't have to say that you will provide them to the government, right? =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdqh6hguzHDTdpL5AQFD4gQAlm9cekEcnq26tQkwTljb+xDGc5wRQL6e D5gqXo2JpCQuLXfdYND5ROoV58T4UL43uXMfo8ziqq2mMNRY5SsNKaOWi+f4bw6c SEhMBeBIzLnd50rIzQvWfRzaVr1NBwKjlOGpmRD9H3lWsap/l2ttog4CdShWRWdv 4GMLwzh+PhE= =Y2+p -----END PGP SIGNATURE-----

1 0

Re: SAFE Forum--some comments
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:34 PM 7/2/96 -0800, jim bell wrote: >However, that AT+T fellow who revealed the phone records to the militia >group would also be an appropriate comparison to destroy the "key-escrow" >idea. I assume AT+T had procedures in place which were SUPPOSED TO prevent >this. Well, key-escrow agents "will" also have similar procedures. Why >should we assume they will be more reliable? We shouldn't. In fact, they will have a much higher economic value. I would expect them to be more vulnerable to insiders. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: CWD -- Jacking in from the "Keys to the Kingdom" Port
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12.10 AM 7/3/96 -0500, Declan McCullagh wrote: >CyberWire Dispatch // Copyright (c) 1996 // >Install the programs and Junior can't access porn. No fuss, no muss, no >bother. "Parental empowerment" is the buzzword. Indeed, it was these >programs that helped sway the three-judge panel in Philly to knock down >the Communications Decency Act as unconstitutional. I've wondered .. could a creative child circumvent these filter programs using a URL-redirecter, like where you see something like http://www.one.site.com/cgi-bin/rd?http://www.porno-site.com/ or are they not URL-based? =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdqkPhguzHDTdpL5AQG77QP7B6oJR9SOeJYyTP9fnad+Yn/fA/ZObaf3 szA2m9Sytxslfd/Juu19KfTTTjncE7dHMBnq6PuyouKD5jwkTnncnXNe7R2Tgjp8 SdVpyUUdFz++lLdBQ1WYos+eCU2QaGqsYe5+79MkHhFOk1XOhAH8zX5hG9kwuO+q 8C9/wuf6ZyU= =NfcF -----END PGP SIGNATURE-----

6 8