December 2003 - cypherpunks-legacy

Re: PGP, Inc.--What were they thinking? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 22 Oct 1997 19:57:59 -0600 > From: TruthMonger <tm(a)dev.null> > Subject: Re: PGP, Inc.--What were they thinking? > *Starts* eavesdropping? Where you been, Bubba? > When a Company has the 'right' to wiretap you, search you, and make > you piss in a jar, as well as having their own armed forces monitoring > you and patrolling your workplace, the main difference between them > and the government is that the corporation usually doesn't pretend > to allow you to vote. This is plain and simple bullshit. There are a variety of differences between a government and what they can do by general charter in a democracy and a company which operates on specific contracts. > TruthMonger ParanoiaMonger is more like it. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Trip to SF/Bay Area around November 24, cypherpunk meeting?
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm thinking of spending a few days in the Bay Area in about a month, maybe the week of Thanksgiving. My S.O., a cypherpunkish Net and telecommunications lawyer here in DC, seems likely to join me. I'd love to come to a Bay Area cypherpunk meeting if there are any then, and spend some time with folks out there. Any plans to have one around Nov 24-27? This is more of a pleasure than a business trip, though I'll write an article if there are any interesting developments on the crypto-front. (Any suggestions on places to stay?) -Declan

1 0

Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
by James Love 17 Dec '03

17 Dec '03

Nifty comment by Michael McMain on JavaLobbyCafe(a)iceworld.org list: -------------------------- A friend at work made an interesting point about MS's claim that IE4 is simply an OS extension and not an application. All the DA has to do is turn on a Power Mac, start IE4, turn to MS and say "So what other parts of your OS run on the Macintosh exactly?".

1 0

DC cypherpunks party on Sunday, November 2
by Declan McCullagh 17 Dec '03

17 Dec '03

A DC cypherpunk working meeting and party is tentatively scheduled for Sunday, November 2. The party is open to all, including non-cypherpunks and even (especially?) NSA spooks. (I somehow got suckered into organizing this portion.) Folks who showed up to my party and the cypherpunk meeting before it last month remember that Marc Rotenberg and his wife at that time volunteered to host the next one. Their home is near the National Cathedral in NW Washington, DC. About a 20 minute walk from the Woodley Park Metro, lots of parking. Special guests likely will include Peter Neumann and Simon Davies. Details forthcoming. -Declan

1 0

(Fwd from f-c) Note from PGP employee on MRK
by Declan McCullagh 17 Dec '03

17 Dec '03

>X-POP3-Rcpt: declan(a)relay.pathfinder.com >Subject: Re: PGP, Inc.--What were they thinking? >Date: Wed, 22 Oct 97 20:38:14 -0400 >x-sender: Jamie-McCarthy.org(a)mm.mailbank.com >From: Jamie McCarthy <jamie(a)mccarthy.org> >To: <fight-censorship(a)vorlon.mit.edu> >cc: "Jason Bobier" <jason(a)pgp.com> >Mime-Version: 1.0 >Sender: owner-fight-censorship(a)vorlon.mit.edu >X-Loop: fight-censorship(a)vorlon.mit.edu >X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ >X-FC-URL: To join send "subscribe" to fight-censorship-request(a)vorlon.mit.edu > >A friend of mine by the name of Jason Bobier <jason(a)pgp.com> happens >to work at PGP, Inc. I'll preface his comments by pointing out that >I'm sure he doesn't speak for the company in any way. > >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. >> >> Without corps buying the product, there is no PGP, Inc., and thus >> no dedication of resources to the production of PGP. This leads us >> back to the floundering state of development that PGP was in >> before 5.0. >> >> They also don't seem to realize that you always have the ability >> to remove the MRK from your list of recipients. >> >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK. That is why we refuse to make them >> required. It is also why there still are freeware and personal >> versions of the product. I wish they would just realize that we >> aren't some evil group of people that are solely plotting how to >> make the most money off of this. Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). >> >> *sigh* OK, enough ranting. Feel free to quote various parts of >> this if you feel like responding to the list. >> >> Jason > > >-- > Jamie McCarthy new email => jamie(a)mccarthy.org > homepage: http://www.absence.prismatix.com/jamie/ > fan of: http://www.nizkor.org/ >

3 2

Very important ! global minutes?
by newsglob＠tnlb.com 17 Dec '03

17 Dec '03

MAKE SURE YOU ARE GETTING ALL THE MINUTES BEING GENERATED TO YOUR NUMBERS NOT JUST U.S. TRAFFIC!! CHAT LINES FOR YOUR SITE OR ADVERTISE IN NEWSPRINT Best customer service for your audiotext advertising needs. Fill out the form here: http://www.stsim.com/info/ Don't just stick with one service bureau ! you might not be getting paid for all your global minutes ,most service bureaus are paying you just for your U.S. traffic and keeping the rest this is how service providers make the most of their profit. PAYOUTS ARE ON THE 1st AND ON THE 15th OF EVERY MONTH..... NUMBERS MUST BE DISPLAYED ON YOUR FRONT PAGE FOR BEST RESULTS!!!! YOUR ACCOUNT WILL BE SETUP WITHIN HOURS !!! Top rates for 011- 592 / 1- 664 / 1- 809 / the international pay-per-call industry is bringing in millions upon millions each year. Get in on the the 1+ dialing prefixes and watch your revenue increase. Advertise by mass emailing, tv, web site, newsprint, magazine in any country!!!! You the advertiser will get a flat rate paid to you for every minute generated on your line(s). Your ad could look something like this. -------------------------------------------------------------------------------------------------------------- The internet's all new interactive date line talk to people live or just listen in call now! 1-664-410-3348 Regular Long Distance Only. --------------------------------------------------------------------------------------------------------------- Talk to Hot Ladies Now! 1-644-410-3349. --------------------------------------------------------------------------------------------------------------- People looking to meet people call now 1-664-410-3350. ---------------------------------------------------------------------------------------------------------------

1 0

Re: Technical Description of PGP 5.5
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <3.0.2.32.19971022210316.00727944(a)netcom10.netcom.com>, on 10/22/97 at 09:03 PM, Lucky Green <shamrock(a)netcom.com> said: >At 07:12 AM 10/15/97 -0700, Kent Crispin wrote: >>Correct me if I'm wrong, but this seems to imply that the CMR fields >>in the key structure are really just a convenience -- if PGP, Inc. >>didn't write an smtp filter that enforced a CMR key, someone else >>(say a firewall vendor) could do so easily, defining whatever >>relationship between keys they wanted. >Anybody with half a brain, a copy of perl, and the PGP 5.0 source from >http://www.pgpi.com/ could write a similar filter in a matter of hours. I made this point at the very begining. Source code is not even needed, all one needs to know is the encryption & signature packet formats to be able to pull the keyID's. >I am going to install PGP's SMTP filter on my box. To make it impossible >to accidentally send unencrypted mail to certain people. :-) I already have this inplace as a Rexx script on my E-Mail client. :)) >>To make that a bit stronger, it seems like *any* model that uses >>persistent encryption keys essentially enables CMR-like functionality >>in a smtp filter -- it could be done using pgp 2.6. My set-up works with 2.6->5.0. It's just not persistent keys but the ability to encrypt to multiple recipiants. Of cource even without these features this functionality can implemented by moveing encryption to the server. Only signing & decryption need to be on the client machines. It may even be more efficent in a corporate enviroment to do so. There are performance questions in a high volumn enviroment but I have developed techniques that greatly enhance the perfomance of PGP when working with large keyrings. I know C2-Net has done work with their Stronghold product for supporting hardware based encryption to improve performance on high volumn servers, it would be intresting to see how well these cards would lend themselves to PGP. >Correct. But this isn't going to stop people from complaining. >PGP 5.5 is considerably better than PGP 5.0. The LDAP support alone is >reason to upgrade. The UI is improved and if you don't want to use >message recovery, just don't turn it on. I will agree that 5.5 is an improvement but to be honest I am not that crazy about it. Not that all of it is PGP's fault alot has to do with the OS it runs on. NT just isn't ready for prime time. I have my own GUI I designed for PGP on the OS/2 platform so I am a little biased in that area. :) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE7+aY9Co1n+aLhhAQFhwgP/SdJSeNgbG/SRgR15gwtb22QFOF/VBEL6 K047yXYEwJ/2Vd/zEwJ8AU/6ycVawtGMFpIGyLQHG91ATVear7CSHmsa6KMPH7EC dtK2bbEQlpJsgGbQpXNt6gHOuKYRZIXp65XIlEvu8qW3CJLUGz+RTNnKOAIFkUe2 JWWYRj7N5Wc= =xwCN -----END PGP SIGNATURE-----

1 0

Re: Singaporean control freaks & CMR
by Anonymous 17 Dec '03

17 Dec '03

Adam Back writes: > The problem is that pgp5.x is both an email encryption system and a > file encryption system. So PGP Inc argue that they need the recovery > features for files. Well OK, but for emails in transit? Define "in transit". Specifically, when exactly does email stop being "in transit". When it is received on a mail server? Transfered to the destination computer? Displayed to the user? Saved in an archive? How long might a piece of email spend "in transit"? Compare and contrast with the amount of time a piece of data from an encrypted phone call spends in transit. Or an SSL protected HTTPS web transaction. Do you understand the difference between transit times of a fraction of a second and of days or weeks? Does this suggest any differences in the need for recovery of encrypted data "in transit"? Not all communications are alike. The longer data spends "in transit" the more need there is for recovery features.

3 2

What RSA & Netscape have to offer
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, While the list is busy knocking PGP for not doing the "right thing" or being the "first ones to blink" I though I would share with the list what some of the "big boys" are doing for the spread of "Strong Crypto to the Masses". Below is from the most current S/MIME draft "draft-dusse-smime-msg-05" dated 19-Oct-1997: 2.6 ContentEncryptionAlgorithmIdentifier Receiving agents MUST support decryption using the RC2 [RC2] or a compatible algorithm at a key size of 40 bits, hereinafter called "RC2/40". Receiving agents SHOULD support decryption using DES EDE3 CBC, hereinafter called "tripleDES" [3DES] [DES]. Sending agents SHOULD support encryption with RC2/40 and tripleDES. I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one should look at what the alternatives are and who are really are friends here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who would sell us all out if it improved their bottom lines do not qualify. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8Iqo9Co1n+aLhhAQGWswP+MnvOCL1EoURWpEPt23I/UIuRWBovby8d AxZS3N8/exnI2M3kDCC2mTUWmvaKdsUnwErnXCQ9nQTDa9B+2VUBlijtkC+nsTV8 Vuv484AU51havdyttE87YMDXx8LSkdWnGXLs8TpjrRXiDZlxPJWIif3haK1hC5kg I3VmdwaZc/4= =7Fan -----END PGP SIGNATURE-----

2 1

Re: PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

jon(a)pgp.com wrote: > This is exactly CMR. The only thing that Business 5.5 does is automatically > add the department for you, and put up the recipient dialog so it can be > taken off. Congrats. On the contrary, it is *not* CMR. CMR encrypts to multiple keys for a single recipient. This system only ever encrypts to one key per recipient. PGP 5.5's ability to force people to encrypt to multiple keys for one recipient is the evil aspect of the design, because it's the one which allows it to be used to enforce GAK. PGP's CMR can be used to force everyone to encrypt to the FBI as well as the NSA. My system can't. I tried very hard to make this distinction clear in my description. I'm amazed that so many people seemed to miss it. Mark

1 0