December 2003 - cypherpunks-legacy

Singapore TOILET ALERT
by Declan McCullagh 17 Dec '03

17 Dec '03

[Apologies to my friends in Singapore, but I am NOT making this up. --Declan] And the top five toilets are... SINGAPORE (Reuters) - A drive to keep public toilets clean and dry is meeting with overwhelming success, the Ministry of Environment said in a "toilet alert" Tuesday. The statement said that in the first week "5,000 Singaporans have called the Clean Public Toilets hotline to identify Singapore's model toilets and to vote for their top five favorite toilets." The ministry launched a poster competition earlier in the month featuring three model toilets and inviting the public to identify their locations, as well as to nominate their favorite public toilets in five categories of locations. Various prizes are involved, including a return trip to Hong Kong to be won in a draw. Singapore is known for public campaigns promoting causes ranging from discouraging littering to encouraging people to have more children. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

8 19

Re: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution)
by Adam Back 17 Dec '03

17 Dec '03

Forwarded with permission, Mark's response: ------- Start of forwarded message ------- Date: Wed, 22 Oct 1997 06:41:49 -0700 (PDT) From: mark(a)unicorn.com To: aba(a)dcs.exeter.ac.uk Cc: mab(a)research.att.com Subject: Re: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution) aba(a)dcs.ex.ac.uk wrote: [Did you intend to send this to the list, or Bcc it? If so, please forward a copy of this reply as well] > What you're describing is an alternate use for CMR: to allow > sales(a)acme.com to have attached to it the request that messages to > that address be encrypted for all the sales people. > > Well that seems reasonable in a way. Still potentially dangerous in > that the NSA will soon enough be asking to be on every one's CMR list. But that's *precisely* what I set out to avoid. The intention is to eliminate the multiple-recipient encryption which is the real problem with PGP 5.5's CMR. The NSA can easily put themselves at the top of the encryption hierachy, but then all mail will *only* be encrypted to the NSA, and the recipient will not be able to read it. Rather than encrypting to multiple recipients, you would encrypt to a single key which is available to all those recipients. > The other alternative is as you say: to have group keys which are > shared amongst the sales people. There are problems with this in > managing the secure distribution of the shared key: sales manager > creates it, and emails securely to all sales team members? > Plausible I suppose. Exactly. Or the individual sales-people create personal 'corporate use keys' and escrow them, or the key is retained in a secure 'black box' which takes incoming email encrypted to the sales department and outputs plaintext. The point is that mail sent to that key can be recovered somehow, but confidential mail sent to their private, personal key cannot. > Problem for both approaches is re-keying: what happens when Fred > leaves the sales team to work for a competitor. I agree. But that can be solved in some fashion; the 'black box' approach, for example. > Really it seems to me that actually having half a dozen sales droids > sharing a key, or being able to decrypt a message because they are all > CMR enforced multiple crypto recipients is a security nightmare either > way :-) Sure, but better than a security nightmare *and* GAK. > Reckon it would be arguably more secure to have the SMTP policy > enforcer decrypt it for them, even. Yep, that was one of the options I listed; the 'black box' above. > I think what PGP are arguing for is ability to recover stored messages > even if they are intended for one recipient only. But this is the one thing they don't seem to have a business case for. In my system, if the mail was encrypted to that recipient's personal key rather than a group key or an individual escrowed key, then the sender had a good reason to do so. In that case, the only reason a company could want to read the mail is for snooping on their employees. I don't believe that PGP or anyone else should be encouraging that. The proxy key stuff seemed interesting, but not something that can be implemented in the next few months. I'm thinking of this as a short-term solution, not long-term. Mark ------- End of forwarded message -------

1 0

We have to keep our keys for HOW long???
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

* The Wall Street Journal reported in July that the Environmental Protection Agency has ordered 71 mining companies in Idaho to submit copies of all of the paperwork they have produced in the last 117 years. EPA says it needs the information to help determine who is responsible for lead pollution in Idaho's Silver Valley. According to the president of one firm, the order was so crazy that the EPA investigators "must not live on this planet." Another pointed out that there are not enough copy machines in the region to handle the work. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.)

1 0

ADMIN: lost messages (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Jeff Barber <jeffb(a)issl.atl.hp.com> > Subject: ADMIN: lost messages > Date: Thu, 23 Oct 1997 08:22:06 -0400 (EDT) > CPunks list administrators, > > There appears to be an occasional breakdown in the list > distribution/reflection. I am sometimes seeing responses to articles > that I haven't received. For example, a message from > spencer_ante(a)webmagazine.com has been the subject of several > follow-ups (according to their In-reply-to fields, it is message > ID <88256538.00787D24.00(a)pcwhub.pcworld.com>). Yes, there are occassional breakdowns in the communications between the list remailers. The reason that there are several of them is if one goes down for more than a few minutes the whole lists doesn't go down which would occur if we were still on a single remailer. In cases such as this I would suggest checking the archives provided by a couple of sites (I thought since I don't check the archives). > Any clues? Things get lost on occassion? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: PGP 5.5 CMR/GAK: a possible solution
by Anonymous 17 Dec '03

17 Dec '03

mark(a)unicorn.com writes: > When a customer wishes to send email to Joe, he would use this public key. > When encrypting, PGP would detect the tag and put up a dialog box pointing > out that this is a corporate key and if they click on the 'confidential' > button it will be encrypted to the user's personal key prior to encrypting > to the corporate key (by which I mean superencryption, to avoid traffic > analysis). The default would be not to superencrypt; and as a side effect > this system would be compatible with any version of PGP for > non-confidential mail (assuming that version understands the encryption > algorithms in use). Neat, automatic superencryption. Could the same idea work with the Pgp method with the CMR key? You would encrypt to the user first, then reencrypt to the combination of user and CMR key. Would this prevent GAK?

2 1

Re: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Adam Back wrote: > No offense Declan, but what has this got to do with cypherpunks, > cryptography, crypto politics etc? (This is not a perrygram, this is > a message saying I found that particular article uninteresting). Adam, I believe that Declan may be trying to keep things in perspective, by reminding us who the actual users of "widespread crypto" will be, GAK or no GAK. As a matter of fact, Declan and I are counting on you to explain the issues involved to our good friend and neighbor, Debbie (details below), and get back to us with her thoughts on the crypto issues which are relevant, from her perspective. * At a celebrity auction in May, Debbie Dacoba of Paw Paw, Mich., bid $8,625 for a pair of Mr. Ed's horseshoes and was so overcome with joy when she won that she had to retreat to the ladies' room for 20 minutes until she stopped crying. Later she told a reporter that she would keep the horseshoes in plastic because specks of brown residue in the nail holes "could be manure, which I hope it is because then I have a piece of him." ManureMonger ~~~~~~~~~~~~ To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.)

1 0

We Do All The Work And You Collect All The Cash
by mktg＠inet.com 17 Dec '03

17 Dec '03

If you're NOT currently looking for an income opportunity, then just delete this message. If you ARE looking for an income opportunity, then... WELCOME TO THE HOTTEST CASH GENERATING PROGRAM ON THE INTERNET! I'm sure that this is not the first opportunity that you have ever run across that claims that you can make a lot of cash, very quickly. But, this just might be the only program you'll ever run across, that can actually make that happen. Every other cash generating program that you've ever run across was probably doomed from the start, for 3 simple reasons. 1) You needed to dedicate a lot more time and effort into the marketing of your program, than you originally planned. 2) You needed to invest a lot more money into the marketing of your program, than you originally expected. 3) Your success depended solely on you. And, unless you're a marketing expert, your expected level of success just wasn't going to be achieved. Well, that's where our expertise comes in. We here at Internet Marketing Services, have been asked to develop an effective marketing system that would require virtually no effort and very little capital. We are proud to tell you, that our experience in this industry has enabled us to create a very low cost, high response, marketing program, that blows away traditional methods of network marketing and advertising. The secret to becoming successful in any business is to get your message to as many people as possible, in a cost effective manner. Through our creative advertising program were able to greatly reduce our costs and we are simply passing the savings on to you. IT'S REALLY AMAZING HOW EASY THIS IS AND HOW BEAUTIFULLY IT WORKS! By compounding our efforts and combining your advertising along with other income opportunity seekers wanting to participate in this highly profitable program, Internet Marketing Services is now able to offer you the best Internet marketing rates available anywhere. HERE'S HOW IT WORKS. Multi-level marketing is still used by some of the largest companies in the world today; Amway, Excel and Avon, just to name a few. This highly effective, multi-level business provides you the same type of opportunity. A business that offers a proven cash generating program, complete with a low cost internet marketing service. THIS IS THE SECRET TO YOUR SUCCESS! If a new customer decides to participate in your program, they simply send you a $5.00 commission. And the best part is, we do all the hard work for you, you just collect your cash. As with all multi-level businesses, your income is generated by recruiting new customers that have the same interest as you. The desire to create a large cash income. And, every state in the USA allows us to legally recruit for you, via the Internet. For an extremely low fee of only $35.00, we will market this highly profitable opportunity to 750,000 people with your name and address inserted into the mailing. Then you just go to your mailbox and collect your cash. That's all there is to it. HERE'S HOW YOUR ADVERTISING DOLLARS COMPOUND. In each mailing your name will be included with 2 other distributors. We will then advertise your opportunity to 250,000 people, in 3 seperate mailings. So your opportunity will be offered to 750,000 different people. EXAMPLE: Mailing #1: 250,000 People Mailing #2: 250,000 People Mailing #3: 250,000 People FOR A TOTAL OF: 750,000 People NOW, LET'S COMPARE COSTS. If you were to send your offer through the postal service, it would cost you $240,000.00, in postage alone. The typical e-mail company charges 1-2 dollars per 1000 addresses mailed to. That would be a minimum of $750.00. Other methods could be even more expensive than using the postal service. As you now can see, by compounding your advertising dollars with other income opportunity seekers, it allows us to offer you a cost effective way to cash in on a proven income generating program. And remember, we do all the work for you. You just go to the mailbox and collect your cash. THIS IS A LEGITIMATE MONEY MAKING OPPORTUNITY. It does not require you to come into contact with people, do any hard work, and best of all you never have to leave the house except to get the mail. This multi-level, e-mail order, marketing program works perfectly, every time. E-mail is the ultimate sales tool of the future, and the future is now! If you ever wanted "THE EASY WAY" to make a lot of money... just follow these 3 easy steps using this sure fire system! STEP 1: Send $5.00 in cash to each of the 3 distributors below. Just like new customers will be sending to you, once your name has been placed onto the mailing. Also, include a seperate sheet of paper with your name as it is to appear on this mailing, along with the words, " I WOULD LIKE TO SUBSCRIBE TO YOUR INCOME OPPORTUNITY NETWORKING SERVICE." Once the 3 distributors receive your $5.00 payment, they will each e-mail us your name, verifying that you have paid them their commission. This service also eliminates the possibility of anyone replacing any existing names on the mailing. #1: Venture Inds. 2308 E. Broadmor Tempe,AZ 85282 #2: P.S.B.Wayne PO Box 572772 Tarzana,CA 91357-2772 #3: Classic Communications 1912 California St. Berkeley,CA 94703 STEP 2: Send $35.00, along with your name and address as you want it to appear on this mailing. (You can use your full name, your initials, a business name or what ever you prefer) Once we receive your payment and verification via e-mail that you paid each distributor their commission; we will automatically position your name and address through all 3 mailings until this offer has been e-mailed to 750,000 people. Be sure to include your e-mail address. Once we receive your payment, we will e-mail you our priority e-mail address. This is how you will notify us that you received your payment from customers that want to paticipate in your program. This is a fool-proof system that eliminates anyone from using your service without paying you your $5.00 commission. You can use this program as many times, and as often as you like. By doing this, it is possilbe to create a perpetual cash income. And yes, we accept personal checks. Make check payable to and send to: Internet Marketing Sevices Dept-L23 2375 E.Tropicana #135 Las Vegas, NV 89119 Please note, Internet Marketing Services does not participate in your offer, nor do we share in your income in any way. Internet Marketing Services is a low cost, internet marketing provider only. STEP 3: Go to your mailbox daily and collect your cash. MAKING MONEY JUST DOESN'T GET ANY EASIER THAN THIS! By now your probably asking yourself, "how much money can I really make?" Below are the results of an Internet survey conducted by www.survey.net: 50% of the people on the Internet have made purchases, 40% have made several purchases, 80% like the idea of shopping on the Internet, 50% of those purchases are computer information related, 50% think of e-mail as their second most important application, 20% have made purchases because "I came across it and I liked it, so i bought it." POSSIBLE EARNINGS PER 750,000 E-MAILS 2% Response @ 15,000 X $5.00 = $75,000 1% Response @ 7,500 X $5.00 = $37,500 1/2% Response @ 3,750 X $5.00 = $18,750 1/4% Response @ 1,875 X $5.00 = $ 9,375 HOW MANY RESPONSES DO YOU THINK YOU WILL RECEIVE? As more and more people look for ways to create wealth and financial security, the need for a successful income opportunity is constantly in demand. This higly effective marketing program has only recently been made available. There are millions and millions of people who haven't yet received this offer. THIS IS STILL VERY MUCH A GROUNDFLOOR OPPORTUNITY! BUT IT WON'T BE FOR LONG! If your fed up with the high cost of marketing and advertising then why not take advantage of this powerful opportunity and start creating wealth for you and your family. We hope that you are one of those unique individuals that does more than just dream about creating wealth and has the foresight to see what an incredible money making opportunity that this really is, requiring no effort and a very small investment. JUST IMAGINE WHAT YOU AND YOUR FAMILY CAN DO WITH ALL THAT CASH! FREE WEBSITE: Would you like to create your own website for business or personal use? Just go to www.freeyellow.com and follow the prompts.

1 0

Re: Bill Gates, the Bully Savior
by Declan McCullagh 17 Dec '03

17 Dec '03

There was a good op-ed in the WSJ on Monday. The Politics of Envy, basically. Why everyone in Silicon Valley hates Microsoft... But some of the complaints about Microsoft come down to personal taste. The masses offend refined sensibilities when they buy Windows 95 in droves. Rein them in! Stop them from buying what they want! Don't let them get free copies of Internet Explorer. I share Lizard's distaste for Microsoft products. My Unix workstation at home has not one MSFT application on it. I have only Microsoft Word on my Duo at work, and I could get by with WordPerfect. But our dislike for their products doesn't mean that we are morally justified in restricting what the company can do. -Declan At 10:42 -0700 10/22/97, Lizard wrote: >Uhm...how do 'we all' benefit from having the same Justice Department which >defended the CDA (and which is pushing for GAK) decide for us all what is, >and is not, part of an operating system? > >These people are not qualified to make ANY judgements about computers -- I >have to assume the 'experts' they got to tell them about OS software are no >more qualified than the 'experts' they got to testify about the CDA (L-18, >anyone?). > >I have no great love for Microsoft (I don't think anyone forced to use >their crappy software does), and, emotionally, I'd like to see them get >taken down a peg -- but legally and ethically, they are not doing anything >wrong. They're just being tough competitors. Microsoft has prospered not >due to any technical brilliance on their part, but due to sheer >incompetance on the part of the rest of the industry, who have made a hobby >of underestimating Bill Gates and overestimating their own customers loyalty. > >It's a pity I'm a mind-flaying victim. If I wasn't, I could forget >principles and ideals and just say, "Microsoft Big. Microsoft Nasty. Uncle >Sam stomp Microsoft. Yay, Uncle Sam." But because I work from principle >FIRST, I have to grant Microsoft the same rights I would grant Sam's Deli >or Joe's Shoe Store, and that includes the right to offer any combination >of products or services they wish, and let the market decide to buy or not. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Re: PGP, Inc.--What were they thinking?
by spencer_ante＠webmagazine.com 17 Dec '03

17 Dec '03

Declan, perhaps the Big Brother vs. The Boss debate has been talked about for years in the crypto community but, as far as I can tell, it hasn't crossed over into the mainstream mediasphere. And that's partly due to the rhetoric of cyberlibertarians, who have consistently pointed their finger (justifiably most of the time) at the evil government, at the expense of seriously analyzing surveillance in the private sector. For example, how many people know what their company's security policy is? Do they read your email? How often and with what cause? I think any type of surveillance system is cause for concern--whether it originates from the government or IBM. Lastly, I think you overestimate the amount of wiggle room folks have in the labor market, which is never perfect. What happens when most of the Fortune 500 starts eavesdropping on company email? (Incidentally, I think that most working people--unlike the digerati--are not in a position to launch their own company.) It reminds me of the drug testing issue. Sure, it sucks and may even be unconstitutional, but that hasn't stopped a lot of companies from doing it. -Spencer (posting this from my the computer in my corporate cubicle) At 15:08 -0700 10/22/97, spencer_ante(a)webmagazine.com wrote: >But with this new product, I agree that they run the risk of alienating >their core user group of cypherpunks and hackers. Encryption is a very >complicated topic that doesn't lend itself well to sloganeering and >histrionics. And one major thing that needs to be pointed out: PGP's key >recovery system is *voluntary and private*--not mandatory and gov. >controlled, which is what the Feds and Louis Freeh have been pushing for. >One potential positive side effect of PGP 5.5 is that it could realign the >crypto debate and force people to consider this question: Whose back door >should netizens be more worried about: Big Brother or The Boss? Spencer, the folks on the cypherpunks list know better than perhaps anyone else that encryption is a complicated topic. I know it's tempting to search for New Things to Say about the crypto debate. I try it myself sometimes. But the question you posed about "whose backdoor should netizens be more worried about" has been debated for years and is hardly new. The short answer to it is: when Big Brother is my Boss, I have remedies. I can leave the company or pressure it to change policies. I can file a union grievance. If all else fails, I can leave the company and start my own. This is not the case when Big Brother is Louis Freeh or Janet Reno. When worldwide GAK is the rule, where else can I go? Also: governments have guns; governments have jails. They have unique coercive powers, which the law and western philosophical traditions recognize -- and try to limit. -Declan (posting this before a soccer game somewhere in virginia)

3 2

PGP 5.5 and the corporate environment
by Roger J Jones 17 Dec '03

17 Dec '03

Just a small aside. Our help desk handles about 50 to 75 "I forgot my password" requests per day. This might be one small motivating factor why corporations desire an alternative method to recover encrypted files.

1 0