December 2003 - cypherpunks-legacy

What RSA & Netscape have to offer
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, While the list is busy knocking PGP for not doing the "right thing" or being the "first ones to blink" I though I would share with the list what some of the "big boys" are doing for the spread of "Strong Crypto to the Masses". Below is from the most current S/MIME draft "draft-dusse-smime-msg-05" dated 19-Oct-1997: 2.6 ContentEncryptionAlgorithmIdentifier Receiving agents MUST support decryption using the RC2 [RC2] or a compatible algorithm at a key size of 40 bits, hereinafter called "RC2/40". Receiving agents SHOULD support decryption using DES EDE3 CBC, hereinafter called "tripleDES" [3DES] [DES]. Sending agents SHOULD support encryption with RC2/40 and tripleDES. I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one should look at what the alternatives are and who are really are friends here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who would sell us all out if it improved their bottom lines do not qualify. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8Iqo9Co1n+aLhhAQGWswP+MnvOCL1EoURWpEPt23I/UIuRWBovby8d AxZS3N8/exnI2M3kDCC2mTUWmvaKdsUnwErnXCQ9nQTDa9B+2VUBlijtkC+nsTV8 Vuv484AU51havdyttE87YMDXx8LSkdWnGXLs8TpjrRXiDZlxPJWIif3haK1hC5kg I3VmdwaZc/4= =7Fan -----END PGP SIGNATURE-----

2 1

Re: PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

tcmay(a)got.net wrote: > Our mileages apparently vary. When _I_ send a message to, say, Jon Callas > at PGP, Inc., it is to Jon Callas, not to others. It might be a job offer, > it might be an invitationf for him to help monkeywrench CMR, it might be a > stock tip, it might be a comment about a conversation we had a party, it > might be a lot of things. Hmm, as usual, you make a good point. The uses I was thinking of were the kind of uses that people have suggested as reasons for CMR; emailing orders, etc to companies. Today I rarely do that because telephoning companies is much easier, and in the future I'd expect to be sending most of them over the Web rather than by email. I presume these *are* the kind of uses that PGP Inc are expecting, since their system seems to have no other value except as snoopware. > If I was sending it to "Jon's coworkers in Department Z," I probably either > wouldn't encrypt it at all, or would (if the option existed) encrypt to > some departmental or group key. Yep, which is basically what I was suggesting. The user chooses which key to use based on their perception of the sensitivity of the message, not the enforced company policy. If it's confidential, it's confidential; if the company think I'm up to no good they can come around and force me to decrypt a particular message, or sack me if I refuse. Their call. > I expect those who adopt CMR will find an awful lot of folks will just give > up on trying to communicate with those living in a CMR regime. Ditto, at least if it's PGP's current 'mandatory voluntary' snoopware design. I won't be running any version of PGP which includes this 'feature' in its current form; I would also suggest that we boycott any scanning and proofreading efforts for future versions of PGP which include this code, or remove it from the source before release. If PGP's commercial customers lose business as a result, that's their choice. Mark

2 1

RE: Bill Gates, the Bully Savior
by Arturo Grapa Ysunza 17 Dec '03

17 Dec '03

Almost. The government should regulate MS for anti-trust reasons. As I mentioned "If MS wins anti-trust litigation then so be it". >---------- >Desde: Lizard[SMTP:lizard@mrlizard.com] >Enviado el: Jueves 23 de Octubre de 1997 11:38 AM >Para: Arturo Grapa Ysunza <cypherpunks(a)toad.com >Cc: 'Jennifer S. Granick' >Asunto: RE: Bill Gates, the Bully Savior > >At 07:20 PM 10/22/97 -0500, Arturo Grapa Ysunza wrote: > >>MS canŽt be blamed for the incompetence of the rest of the industry. If >>MS wins anti-trust litigation then so be it but someone has to keep them >>in check. We elect the people who appoint others to review these >>matters. > >Lemme see if I've got this straight. > >The rest of the industry, due to stupidity, lethargy, or other >incompetance, can't compete succesfully with Microsoft. > >Therefore, the government must regulate Microsoft, in order to give the >other companies a fair chance. > >Uh-HUH. > >Who is John Galt? >

1 0

PGP and CMR: Just a Few Lines...
by Fisher Mark 17 Dec '03

17 Dec '03

A point that I still feel gets lost by some participants in this issue is that the changes to PGP for CMR/GMR are very minor -- all that needs to occur is to get the CMR keys from wherever they are stored, and then add them as additional recipients. The political value of persuading PGP to adopt CDR >> actual technical value, as the change to CMR should involve < 10 lines of code (said, of course, without actually inspecting the code :). ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Re: PGP, Inc.--What were they thinking?
by Declan McCullagh 17 Dec '03

17 Dec '03

>X-POP3-Rcpt: declan(a)relay.pathfinder.com >From: spencer_ante(a)webmagazine.com >X-Lotus-FromDomain: PCWORLD >To: whgiii(a)invweb.net >cc: hallam(a)ai.mit.edu, declan(a)well.com, aba(a)dcs.ex.ac.uk, tcmay(a)got.net, > fight-censorship(a)vorlon.mit.edu >Date: Thu, 23 Oct 1997 10:36:44 -0700 >Subject: Re: PGP, Inc.--What were they thinking? >Mime-Version: 1.0 >Sender: owner-fight-censorship(a)vorlon.mit.edu >X-Loop: fight-censorship(a)vorlon.mit.edu >X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ >X-FC-URL: To join send "subscribe" to fight-censorship-request(a)vorlon.mit.edu > > >So, I was driving to work this morning listening to KQED's Forum program >and lo and behold: Good 'ol Michael Krasny is leading a discussion on >surveillance in the workplace that centered around a new survey/special >report that PC World just published in its November issue. > >You Are Being Watched >An exclusive PC World survey of 200 company executives shows that more and >more businesses are >monitoring their employees' Web use. Here's the lowdown on what you should >know about surfing >the Net on company time. > >http://www.pcworld.com/workstyles/online/articles/nov97/1511p245.html > >Should provide some interesting points for discussion. > ><<<S>>> >

1 0

No Subject
by LEANDRO R. PREDA 17 Dec '03

17 Dec '03

Please I need your help! I need of coputers virus , To I infectin the my computers school

1 0

Elliptic Curve Cryptography
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Is Elliptic Curve Cryptography a better encryption system than RSA ? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Re: PGP 5.5 and the corporate environment
by Antonomasia 17 Dec '03

17 Dec '03

> Just a small aside. Our help desk handles about 50 to 75 > "I forgot my password" requests per day. This might be one > small motivating factor why corporations desire an alternative > method to recover encrypted files. >From my experience I'm sure most of those are due to daft password aging mechanisms. over-frequent compulsory changes forcing a change at no notice (password expired - think of a new one RIGHT NOW) forcing a new password on Fridays (Monday morning: I know my _old_ password!) I have practically no trouble remembering numerous passphrases upwards of 20 mixed chars if I use them semi-regularly and they don't change often. Anyway, when I have forgotten a long passphrase it has only been temporarily - a few days. If your employee is reasonably confident of decrypting his work within the week you're no worse off than if he'd fluffed his cooking ("stand in boiling water" or something). -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Re: Note from PGP employee on MRK (sic)
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Declan McCullagh wrote: >A friend of mine by the name of Jason Bobier <jason(a)pgp.com> happens >to work at PGP, Inc. I'll preface his comments by pointing out that >I'm sure he doesn't speak for the company in any way. > >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. >> >> Without corps buying the product, there is no PGP, Inc., and thus >> no dedication of resources to the production of PGP. This leads us >> back to the floundering state of development that PGP was in >> before 5.0. >> >> They also don't seem to realize that you always have the ability >> to remove the MRK (sic) from your list of recipients. >> >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK (sic). That is why we refuse to make them >> required. It is also why there still are freeware and personal >> versions of the product. I wish they would just realize that we >> aren't some evil group of people that are solely plotting how to >> make the most money off of this. Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). >> >> *sigh* OK, enough ranting. Feel free to quote various parts of >> this if you feel like responding to the list. I would hope that the employees of PGP, Inc. take a deep breath and seriously consider the many cogent and well thought out points its critics have made. We haven't seen much of this, unfortunately. (And those who are claiming that their critics are rude should recall how Dorothy Denning was treated.) It is the unfortunate reality that good people can join a good company which then later does bad things. This can occur due to moles and internal subversion, greed, or simply foolishness. I have seen repeated claims by PGP, Inc. employees that they are privacy zealots. I'm sure some of them really believe what they are saying. But, these points are irrelevant if the result is the wide dispersal of tools which can be effortlessly converted into a mandatory GAK system. A number of people have been arguing that it is necessary for the company to issue snoopware because they can make money doing it. How often have we rejected this argument when the company is AT&T, ITT, Standard Oil, United Fruit, or Microsoft? This rejection is proper, and it applies to PGP, Inc. like any other company. Another claim is that by making money selling snoopware, the proceeds may be taken and used for privacy software. Wouldn't it make more sense to earn money in some more palatable way and then plough the proceeds into a company which is writing privacy software? I'm sure most PGP, Inc. employees would reject the "We had to destroy the village to save it" line of thinking if it were found in any other context. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNE+ow5aWtjSmRH/5AQFsWAf+LWjZNCdR6jdAsffX4PR6KLhX8W+V4jkQ J6odSQNpStVkFhPtcByG+AWaPQLmKxlwVKcO44pQVhTIDhMUlFniSnYtQ/zq+6RF aeqNG7WLE/58g9Pgh78iBOfJ4wKLi/U5dzpdDX1Ua86B8uzcGKVGTerbN6QoFwH2 aOd2tytomYWmFQeMdguN43Ak9hP+ruA1dcqrlZjRPhEBhBJOfbYLSYt3GPDn6Cqq jTL/Ui3fu4KHcK8zGgVnXVwQNL0XubBhQmTZ54ohxywejt1A2Q4g4sh0oxvSCEDY giqk4uElp5an7K+N1tY+vExvkjdRkjsAQEtFAgp4fzHozbS5jNXBWA== =FFl7 -----END PGP SIGNATURE-----

1 0

Use crypto, face a death squad
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

There have been various rumours and comments over the past few years that the use of crypto in certain countries (Syria, Iraq, possibly China) is very dangerous for the end user, but very little actual evidence to substantiate this. About a week ago I got some evidence (well, something better than the usual rumours) on the situation with using crypto in Iraq which people might find interesting. I was talking to someone who worked for a large multinational corporation which maintains a comprehensive directory of who to contact in each country they operate in (basically every country on earth, this was before the gulf war so Iraq was included) for any kind of emergency. This consists of a huge file of data intended to cover every imaginable type of situation. Included in the information on Iraq was a comment to the effect that you should never, ever use any form of encryption when sending messages to the contact people there. He can't remember the exact details any more, but the implication was that any encrypted messages sent to them would result in them quietly disappearing. Since this was a very big company with a lot of sensitive information which it would go to great lengths to protect, I would assume they had very good reasons for advising against the use of crypto in this instance. Peter.

4 3