December 2003 - cypherpunks-legacy

Announcement
by Phillip R. Zimmermann 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In light of the great amount of discussion currently taking place in regard to the benefits and disadvantages of my latest bid for money, power, fame and the respect of the corporate computer industry, I would like to reassure the cynics that my committment to privacy has never been stronger. However, I have reassessed my views of who truly has a right to control access to privacy and have come to the conclusion that privacy is too important an issue to be left in the hands of the individual, with the obvious potential for misuse. After a review of the astounding success of the PGP Public Key Server's use, in conjunction with our PGP Privy Products, in ensuring proper key management and control of forgery, spoofing and misuse of Public/Private Key technology, it has become clear that individual privacy can best be ensured under the watchful eye of those with the resources to provide proper surveillance of those who have earned the right to privacy, in order to prevent abuse of that right. I would like to thank my other brother, Phil (Hallam-Baker), for helping me to see that unsupervised use of the right to privacy could result in individuals misusing that right to publish extremely embarassing pictures of me in compromising positions which could affect my credibility. As a matter of fact, it was PH-B who suggested my new signature line. PRZ ~~~ "I don't put them in the PGPtray...I just turn on the GAK." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE/sV17MfpC8gEO7EQKaCQCePKAo033KBg/O/T9Nz5IrGLIcCZcAn0L4 JDtdMovT9RZKA4PXwJTNdvpr =Xvzl - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE/svUlfPVhsMJvfEQI2zgCg8aQ15PEU4eNItEprsLQHd2259fIAn2a1 wwKyecnoEQuCElB3ZtJBZQBz =53jb -----END PGP SIGNATURE-----

1 0

CMR versus GAK?
by nobody＠neva.org 17 Dec '03

17 Dec '03

"Big Brother or the Boss?" Are you SURE that's a dichotomy? Big Biz and Big Gov are almost inextricably intertwined these days. If dot-com pushes for snoopware, it is called CMR. If dot-gov pushes for it, it is called GAK. The real question is, if the interests of Biz and Gov coincide, and "real cooperation" is achieved, does it really matter where the idea originated? Either way you still have snoopware. Cpl Kaos

3 5

RE: Bill Gates, the Bully Savior
by Arturo Grapa Ysunza 17 Dec '03

17 Dec '03

Almost. The government should regulate MS for anti-trust reasons. As I mentioned "If MS wins anti-trust litigation then so be it". >---------- >Desde: Lizard[SMTP:lizard@mrlizard.com] >Enviado el: Jueves 23 de Octubre de 1997 11:38 AM >Para: Arturo Grapa Ysunza <cypherpunks(a)toad.com >Cc: 'Jennifer S. Granick' >Asunto: RE: Bill Gates, the Bully Savior > >At 07:20 PM 10/22/97 -0500, Arturo Grapa Ysunza wrote: > >>MS canŽt be blamed for the incompetence of the rest of the industry. If >>MS wins anti-trust litigation then so be it but someone has to keep them >>in check. We elect the people who appoint others to review these >>matters. > >Lemme see if I've got this straight. > >The rest of the industry, due to stupidity, lethargy, or other >incompetance, can't compete succesfully with Microsoft. > >Therefore, the government must regulate Microsoft, in order to give the >other companies a fair chance. > >Uh-HUH. > >Who is John Galt? >

1 0

[RANT] Why America Can't Compete
by Eric Cordian 17 Dec '03

17 Dec '03

I've just uncovered a massive plot to destroy our nation's competitiveness and inculcate its young people in the collectivist mentality. The tool? Youth sports! This morning's AP wire reports that two football coaches are suing a youth football league after being banned for life because their 11 and 12 year old players won by too large a point spread. Apparently, and I find this truly shocking, it is a common practice in youth sports today to have a rule limiting the number of points by which a game may be won, with horrendous sanctions for violating it. Winning by more than that, it is argued, is "demoralizing" to the other team, and (Gasp!) UNETHICAL! Once the designated point spread is reached, coaches must order their players to deliberately lose, play badly, and act retarded. I became aware of this idiotic practice after I mentioned the AP article to several people, and rather than throwing up their arms in horror, they volunteered that their own local teams had such rules as well. It's time to check closely, to make sure such shenanigans are not afoot in your town, polluting the entrepreneurial spirit of your very own children. Imagine if Ross Perot had played on such a team, or Bill Gates, or Adolf Hitler? The entire course of history might have been changed. ----- FRIENDSWOOD, Texas (AP) -- Two volunteer coaches are taking a youth football league to court after they were banned for life because their 11- and 12-year-old players couldn't resist playing hard. After the Sagemont Cowboys destroyed the Friendswood Chiefs 62-0 on Oct. 4, the Bay Area Football League banned twin brothers Roy and Rene Aguilar -- whose team has dominated the league for several years. ``They're saying that because we demoralized the other team and that we are teaching the kids unethical practices that we're out for life,'' Rene Aguilar, the team's assistant coach, said in Wednesday's editions of The Galveston County Daily News. The league has a rule that prohibits teams from winning by more than 42 points. The Aguilars say they told the team to slow down after building a 42-0 lead, but the players couldn't help scoring again. The Friendswood Chiefs, named after this Houston suburb, fumbled the ball in their own end zone and Sagemont recovered to increase its lead to 48-0. Rene Aguilar said the coaches tried to tell the players not to recover the fumble. ``That's confusing to them,'' he said. ``One minute we're trying to tell them to play hard, then we're telling them to lay down.'' Recovering that fumble, according to a league rule, meant a one-game suspension for the head coach and a $100 fine for the team. Rene Aguilar said the Sagemont club president was at the game and told the coaches to handle the situation however they saw fit. ``So we played the rest of the game because we already knew we were going to be penalized,'' he said. The Cowboys went on to score another 14 points. League officials met two days later and gave the Aguilars a lifetime ban. A judge granted the Aguilars a restraining order to prevent the ban from taking effect, but the order expires Friday. The Aguilars met with the league officials late Wednesday for private mediation in an effort to avoid a court hearing Friday. ``We're not allowed to discuss what went on,'' Peggy Bittick, the coaches' attorney, told The Associated Press late Wednesday. ``We're going full force to court.'' Calls to league officials were not returned. Ms. Bittick said she watched a videotape of the game and it appeared that Friendswood was not trying to recover the fumble. ``It looked like the other team just threw up their hands and gave up.'' -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

2 1

PGP and CMR: Just a Few Lines...
by Fisher Mark 17 Dec '03

17 Dec '03

A point that I still feel gets lost by some participants in this issue is that the changes to PGP for CMR/GMR are very minor -- all that needs to occur is to get the CMR keys from wherever they are stored, and then add them as additional recipients. The political value of persuading PGP to adopt CDR >> actual technical value, as the change to CMR should involve < 10 lines of code (said, of course, without actually inspecting the code :). ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Re: PGP, Inc.--What were they thinking?
by Declan McCullagh 17 Dec '03

17 Dec '03

>X-POP3-Rcpt: declan(a)relay.pathfinder.com >From: spencer_ante(a)webmagazine.com >X-Lotus-FromDomain: PCWORLD >To: whgiii(a)invweb.net >cc: hallam(a)ai.mit.edu, declan(a)well.com, aba(a)dcs.ex.ac.uk, tcmay(a)got.net, > fight-censorship(a)vorlon.mit.edu >Date: Thu, 23 Oct 1997 10:36:44 -0700 >Subject: Re: PGP, Inc.--What were they thinking? >Mime-Version: 1.0 >Sender: owner-fight-censorship(a)vorlon.mit.edu >X-Loop: fight-censorship(a)vorlon.mit.edu >X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ >X-FC-URL: To join send "subscribe" to fight-censorship-request(a)vorlon.mit.edu > > >So, I was driving to work this morning listening to KQED's Forum program >and lo and behold: Good 'ol Michael Krasny is leading a discussion on >surveillance in the workplace that centered around a new survey/special >report that PC World just published in its November issue. > >You Are Being Watched >An exclusive PC World survey of 200 company executives shows that more and >more businesses are >monitoring their employees' Web use. Here's the lowdown on what you should >know about surfing >the Net on company time. > >http://www.pcworld.com/workstyles/online/articles/nov97/1511p245.html > >Should provide some interesting points for discussion. > ><<<S>>> >

1 0

No Subject
by LEANDRO R. PREDA 17 Dec '03

17 Dec '03

Please I need your help! I need of coputers virus , To I infectin the my computers school

1 0

Re: PGP Employee on MKR
by Anonymous 17 Dec '03

17 Dec '03

> FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP > AWAY FROM GAK. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT > IS ONE STEP AWAY FROM GAK! FORCING ENCRYPTION TO MULTIPLE KEYS FOR > ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! FORCING ENCRYPTION TO > MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! > !!!*FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE > STEP AWAY FROM GAK*!!! Mark, just remove the self signature on the user key. The message recovery key packet goes away! That's all you have to do. Is that so tough? This big threat, the dangerous CMR key, turns out to take two seconds of user actions to be destroyed. Something this easy to turn off will never be good enough for GAK. People say, "Oh, but then the government will make everybody run the policy enforcer and reject any mail not encryped to the government." First, if they were going to do this, they could do it with old versions of PGP too. Multiple recipients have been around practically forever. Second, it's a ridiculous idea which ignores how email works. More and more people are running systems at home which could send and receive SMTP mail. The trend is towards home servers which support the multiple home computers people will have in the next decade. There's no way to make those people run filters! People say, "Oh, but they'll make it illegal to receive mail at home without going through an ISP." I'm serious, this has actually been suggested on this list. It has to be suggested, because it's the only way this incredibly stupid scenario could be made to work. I can only assume that people are blinded by emotions or they wouldn't suggest such a bizarre idea. Making it illegal to implement probably the most widely used internet protocol package (email) would be a totally unprecedented, invasive, unjustifiable and unenforcable intervention by government. If the only way the government can enforce GAK is by making it illegal for people to receive email through paths which don't pass through government filters we can all rest easy, because it will never happen. Even for the cases where filtering is done (like businesses), there are easy countermeasures, described by no other than Jon Callas, PGP's chief scientist! Why would he say this if there were a massive conspiracy to enable GAK? He's also the one who explained the point above about the self signature. He has suggested two other easy workarounds: Modify the PGP 5.0 source to put a fake recipient block on it. How many companies release their source so that you could do this? Or superencrypt to the real end user, like you suggested in your scheme. Why is this OK as a privacy workaround for your idea but it doesn't count for PGP? Then people say, "Oh, but PGP shouldn't have written the SMTP filter anyway (or at least they shouldn't have put that one policy in) because it would make it easier for the government to make everybody use it." Ignoring all the considerations above about what a stupid idea this is, the fact is that a simple filter like this is incredibly easy to write. I'm sure a skilled Perl hacker like Adam Back could put together something to check that a PGP message is encrypted to a desired key in a few hours. There are already Perl scripts out there to help parse PGP messages. You just have to look at the recipients and compare with the key you want to see. The existence of such a filter is totally insignificant in the big picture. If we are ever forced into a GAK system and filtering turns out to be a part of the picture, it will be trivial for such filters to be created. PGP's SMTP product will not make any difference one way or the other. The fact is, nobody has come up with a scenario where PGP's CMR feature can be turned into GAK in any practical way. They have to assume that all kinds of changes and additions are made - inability to remove CMR keys, forcing everyone to run SMTP filters, making it illegal to receive email at home, preventing people from implementing clients with workarounds, changing the technology to make it harder to implement workarounds using binding cryptography. Any system can be turned into GAK if you're allowed to postulate these kinds of changes. And the fact is that every GAK system so far designed can be trivially defeated. The big GAK danger has always been that the encryption manufacturers would release GAK-only versions of their software, so that you have a choice between an easy to use system with GAK support, or a difficult and balky product like PGP 2.6.2, distributed via underground means and with GAK workarounds. Now at last you can be sure that even if the very worst happens, you will at least have the convenience and ease of use of PGP 5.0 as the GAK disabled product, via a non-GAK international version. This doesn't have anything to do with PGP's policies or motives; it is strictly because of PGP 5.0's source distribution, which will make it easy for cypherpunks to modify it to look compliant with GAK while using superencryption or some other technology to avoid it. No longer will it be a choice between convenient GAK or clumsy non-GAK, opening the latter option only to cypherpunks and hackers. Now people opposed to GAK will be guaranteed an option of making their software at least as easy to use as PGP 5.0. If source code becomes available for PGP 5.5, that will raise the guaranteed ease of use of non-GAK software even further (by all accounts, 5.5 has an even better interface than 5.0). The existence of these products in source code form will forever stand as a barrier to any hope to coax (most) people into using GAK software by forcing it into built-in products, leaving the alternative of non-GAK software only to a tiny minority. This in itself should monkey wrench any government plans for requiring GAK.

3 2

Re: PGP 5.5 and the corporate environment
by Antonomasia 17 Dec '03

17 Dec '03

> Just a small aside. Our help desk handles about 50 to 75 > "I forgot my password" requests per day. This might be one > small motivating factor why corporations desire an alternative > method to recover encrypted files. >From my experience I'm sure most of those are due to daft password aging mechanisms. over-frequent compulsory changes forcing a change at no notice (password expired - think of a new one RIGHT NOW) forcing a new password on Fridays (Monday morning: I know my _old_ password!) I have practically no trouble remembering numerous passphrases upwards of 20 mixed chars if I use them semi-regularly and they don't change often. Anyway, when I have forgotten a long passphrase it has only been temporarily - a few days. If your employee is reasonably confident of decrypting his work within the week you're no worse off than if he'd fluffed his cooking ("stand in boiling water" or something). -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Re: Note from PGP employee on MRK (sic)
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Declan McCullagh wrote: >A friend of mine by the name of Jason Bobier <jason(a)pgp.com> happens >to work at PGP, Inc. I'll preface his comments by pointing out that >I'm sure he doesn't speak for the company in any way. > >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. >> >> Without corps buying the product, there is no PGP, Inc., and thus >> no dedication of resources to the production of PGP. This leads us >> back to the floundering state of development that PGP was in >> before 5.0. >> >> They also don't seem to realize that you always have the ability >> to remove the MRK (sic) from your list of recipients. >> >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK (sic). That is why we refuse to make them >> required. It is also why there still are freeware and personal >> versions of the product. I wish they would just realize that we >> aren't some evil group of people that are solely plotting how to >> make the most money off of this. Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). >> >> *sigh* OK, enough ranting. Feel free to quote various parts of >> this if you feel like responding to the list. I would hope that the employees of PGP, Inc. take a deep breath and seriously consider the many cogent and well thought out points its critics have made. We haven't seen much of this, unfortunately. (And those who are claiming that their critics are rude should recall how Dorothy Denning was treated.) It is the unfortunate reality that good people can join a good company which then later does bad things. This can occur due to moles and internal subversion, greed, or simply foolishness. I have seen repeated claims by PGP, Inc. employees that they are privacy zealots. I'm sure some of them really believe what they are saying. But, these points are irrelevant if the result is the wide dispersal of tools which can be effortlessly converted into a mandatory GAK system. A number of people have been arguing that it is necessary for the company to issue snoopware because they can make money doing it. How often have we rejected this argument when the company is AT&T, ITT, Standard Oil, United Fruit, or Microsoft? This rejection is proper, and it applies to PGP, Inc. like any other company. Another claim is that by making money selling snoopware, the proceeds may be taken and used for privacy software. Wouldn't it make more sense to earn money in some more palatable way and then plough the proceeds into a company which is writing privacy software? I'm sure most PGP, Inc. employees would reject the "We had to destroy the village to save it" line of thinking if it were found in any other context. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNE+ow5aWtjSmRH/5AQFsWAf+LWjZNCdR6jdAsffX4PR6KLhX8W+V4jkQ J6odSQNpStVkFhPtcByG+AWaPQLmKxlwVKcO44pQVhTIDhMUlFniSnYtQ/zq+6RF aeqNG7WLE/58g9Pgh78iBOfJ4wKLi/U5dzpdDX1Ua86B8uzcGKVGTerbN6QoFwH2 aOd2tytomYWmFQeMdguN43Ak9hP+ruA1dcqrlZjRPhEBhBJOfbYLSYt3GPDn6Cqq jTL/Ui3fu4KHcK8zGgVnXVwQNL0XubBhQmTZ54ohxywejt1A2Q4g4sh0oxvSCEDY giqk4uElp5an7K+N1tY+vExvkjdRkjsAQEtFAgp4fzHozbS5jNXBWA== =FFl7 -----END PGP SIGNATURE-----

1 0