December 2003 - cypherpunks-legacy

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Kent Crispin wrote: >Words fail me. This is completely idiotic. Indeed. It's just as idiotic as people being killed for receiving encrypted mail in Iraq. It is, however, just as possible, and anyone who believes the contrary obviously hasn't worked for a big company before; I've seen them do far, far, more idiotic things in the past. Mark

2 1

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>Gee, Mark, I thought it was the SMTP filter that did the enforcing. >Maybe if PGP didn't call it "CMR" but instead called it something >neutral like the "key link field". Duh, without the 'mandatory voluntary' encryption to multiple keys, the enforcer couldn't work. Sure, the Feds could say 'encrypt to the FBI key or else', but users wouldn't be able to do so automatically without getting scripts to do so and the revolt would be too large for even the FBI to handle. It must be done automatically in the software, or it won't work. >Let's see, your scenario involves putting super sniffers at strategic >positions throughout the net, and passing laws that not only supports >this, but makes it illegal to go around them. I suggest that if such >laws are passed PGP's software is the least of your problems. How is this significantly different from mandatory wiretap access laws which already exist? Since it only requires action on the part of Internet providers, it's not going to raise the kind of outcry that other more widespread laws would create. >To make it plain, Mark, I "explain it away" this way: fundametally, >your scenario assumes what it is trying to prove -- you assume that >incredibly draconian laws are in place, Incredibly draconian? In what sense? Having to set a bit in your generated PGP keys? It certainly would be draconian if the FBI passed such a law today and required everyone to dump their software in favor of new, GMR-enabled software, but all new copies of PGP are already GMR-enabled. In fact, the FBI could probably stage a public relations coup by giving away free copies of PGP to anyone who asked. Draconian would be coming around to your house and taking your keys by force. Draconian is not merely enabling an option which your software currently supports. The whole point of not wanting PGP to ship this system is that it would allow the FBI to snoop *without* truly draconian laws. Without the current CMR system the FBI would have to force everyone to change to new software; deployment wins. As I said, 'don't worry, it won't happen, be happy'. Nothing new. Mark

1 0

Forgery
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Forgery is the sincerest form of plagiarism.

1 0

IW resources
by Steve Schear 17 Dec '03

17 Dec '03

I was cleaning up my HD when I came across a 43 page PowerPoint presentation by Carlo Kopp called "The E-bomb - A Weapon of Electrical Mass Destruction." It contains a good amount of technology, use and threat assessment data for this sort of EW device. Very professional. It was given at IWC-V 1996. A good candidate for amateur experimentation ;-) A little alta-vista search brought up Kopp's home page (with links to the above paper) and a wealth of related material, in particular http://www.au.af.mil/au/2025, the Austrailian Air Forces Year 2025 look in to the future, with a link to http://www.xp.hq.af.mil/xpx, the US Air Force's Strategic Planning Directorate. Very good IW reading. --Steve

1 0

RE: PGP Employee on MKR
by Fisher Mark 17 Dec '03

17 Dec '03

>> Not to mention that *ANY* crypto system can be turned into GAK if >> the FBI & NSA get congress to pass the laws that they want. > >Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't >care that any Perl hacker can write a script which builds CMR into PGP >2.6.2, because those scripts are restricted to those who wish to use >them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!! But the changes to add GAK/GMR/CMR to PGP (or any other crypto product that permits multiple recipients) are close to trivial. Don't be fooled into thinking that if PGP takes this "feature" out (can't be a bug -- it's documented :) that that will make it a lot harder to add that feature back in once the appropriate laws are passed. Still, in retrospect, PGP's engineers and scientists should have thought about all the security implications of CMR -- they might have implemented CDR to begin with. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

2 1

The spoofers have gotten more sophistocated!
by vcarlos35＠juno.com 17 Dec '03

17 Dec '03

The people that have been spoofing Jason Bobier, Philip Zimmerman, and Randall Framer have recently become more sophistocated in their techniques. They started with barely disguised headers and moved to equally lame PGP signed messages (that nobody in their right mind would accept, since the public keys have NO TRUSTED INTRODUCERS). Next, they progressed to faking the server-bounce messages to avoid giveaway headers. For example, they did a very good forgery of a email message supposedly coming from PGP, even included the "shival.pgp.com" and "fusebox.pgp.com" portions with correct IP addresses and all. I have a feeling this problem will only get worse....

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

whgiii(a)invweb.net wrote: > There is a simple solution to that don't work for one if you don't like > their policies. I agree; that's why I don't. But I see an inconsistency here. PGP keep telling us that CMR isn't so bad because you can work around it, or superencrypt, or otherwise avoid the company's right to snoop on all communications. Yet you, who believe in this right, support CMR, which can be used to defeat that right, over simple escrow of employee's corporate communication keys. Why? Again, I'm not saying that the companies have no such right. Personally I'd rather escrow my corporate key than see widespread CMR in its current form. Mark

2 1

Re: GMR in the talked-about form here would be unconstitutional
by mark＠unicorn.com 17 Dec '03

17 Dec '03

tcmay(a)got.net wrote: > I agree that draconian crypto laws are afoot, but I don't discount the > power of constitutional challenges. That's probably true: that it's unconstitutional is almost certainly true, that it would be overturned seems less certain. The question is, is that grounds for complacency? I'd rather see people use technology which can't be used against them than hope that such laws would be overturned. Mark

1 0

Re: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
by Paul H. Merrill 17 Dec '03

17 Dec '03

James Love wrote: > > Nifty comment by Michael McMain on JavaLobbyCafe(a)iceworld.org > list: > > -------------------------- > > A friend at work made an interesting point about MS's claim that IE4 is > simply an OS extension and not an application. All the DA has to do is > turn on a Power Mac, start IE4, turn to MS and say "So what other parts > of your OS run on the Macintosh exactly?". The MS assertion is not that IE only works within the OS. Just that it is a part. PHM

3 2

FYI: Tygar talk on Monday, November 3 at Harvard
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: kentborg(a)pop.tiac.net Date: Fri, 24 Oct 1997 11:42:25 -0400 To: Robert Hettinga <rah(a)shipwright.com> From: Kent Borg <kentborg(a)borg.org> Subject: FYI: Tygar talk on Monday, November 3 at Harvard Mime-Version: 1.0 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Having recently come out of retirement (my temporary early retirement, longer than I would have dreamed I could have pulled off, was wonderful), I have not hit upon a smooth stride in my email reading techniques. Riding the bus (most) every day means that I am going to be running up to date on my Herald Tribune, Economist, Byte, Science News, Scientific American, etc., but I am behind on such things as the DCSB mailing list. So I don't know whether this has gone by on the list, you might want to send it out: >From: rivest(a)theory.lcs.mit.edu (Ron Rivest) >Date: Fri, 24 Oct 97 11:29:49 EDT >To: cis-seminars(a)theory.lcs.mit.edu >Subject: FYI: Tygar talk on Monday, November 3 at Harvard > > > > Harvard University > Computer Science Colloquium Series > > Atomicity in Electronic Commerce > > Doug Tygar > Computer Science Department > Carnegie Mellon University > > Monday, November 3, 1997 > 4 PM > Pierce Hall 209 > (Tea at 5 pm Brooks Room) > > >Abstract > >The explosion of the Internet has brought with it a >desire to allow information goods to be bought or sold >over the network. Several schemes for realizing this >have been proposed over the last year, and there are a >number of commercial ventures to support electronic >commerce. > >In the first part of this talk, I examine several >protocols for electronic commerce from the perspective >of the distributed transactions. Most models of >electronic commerce have presumed a highly-available >error-free network. I argue for a more realistic model >of commerce using notions of atomicity in electronic >commerce, and propose three levels of atomic >transactions. I will discuss how to exploit network >failures to explicitly attack commercially used >protocols and fraudulently obtain goods or money. > >In the second part of the talk, I will discuss two very >different approaches to achieving high degrees of >atomicity: the first, an internet billing system >called NetBill is being used to allow highly atomic >microtransactions of information goods. This >technology has recently been licensed for commercial >use. The second approach, Information Based Indicia, >uses secure coprocessor hardware to ensure atomicity, >and is being adopted by the US Postal Service to >address their problem of theft of postage through >counterfeit postage indicia. > > >Host: Professor Michael Rabin > > > > > > > > > > > -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFDB4dL/GwYma/g5EQIziQCbBjVOiEzn11yQKX0htHS2cVCPZJ8AoMXM aMpfEIV0cYxcgdmFgLV0gmD6 =jeyE -----END PGP SIGNATURE----- -- Kent Borg kentborg(a)borg.org W: +1-781-768-2300 x1741 H: +1-617-776-6899 "The creative instinct has always been a stronger motive than mere profit to do truly new and revolutionary things." - Phil Karn --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0