- cypherpunks-legacy - lists.cpunks.org

Who has the right to read your e-mail? Old hash, but I need to ask.
by (Bill) 17 Dec '03

17 Dec '03

A recent incident brought this up at work. If someone could point me to a site that would help explain the in's and out's of the laws regarding the following - Who has the right to read your personal e-mail. E-mail created at work? E-mail downdloaded at work? E-mail stored on a PC at work? Thanks vwbug(a)iadfw.net

1 0

Re: The future will be easy to use
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Mon, 27 Nov 1995 11:06:13 -0800 (PST) >From: Raph Levien <raph(a)c2.org> > Form this perspective, let's take a look at the recent thread on >"establishing trust." Carl Ellison advocates the MOSS alias system. My >understanding of this system is that individual users associate "aliases" >with public keys. If done right, it can work well. However, from a >usability perspective, it is just one more trouble spot. Yes, it could easily be done wrong in such a way that the user gets confused rather than helped; burdened rather than relieved. I advocate aliases because that's how *I* think. I think in words so I assign my own names (aliases) for the people who populate my mental model of the world. By definition, these are all my correspondents. It's possible of course that some other people (of different Myers-Briggs type, perhaps) think differently -- not in words or aliases. If that's true, we should find out how they think and associate the right thing for them. For example, I had a friend (a painter/sculpter) who thought in images. She might prefer to use little pictures or icons (of her own drawing) as the aliases. > First, on what basis will users decide which keys are worthy of being >assigned which aliases? Public keys are big hunks of base64 encoded >gibberish. They are difficult to present in a user interface, difficult >to communicate in alternate, known secure channels (such as telephone >calls and face to face communication). There is no way that a person >could memorize one. That's true. What the user would have to see is some icon (or, for text-bound folks, a temporary unique string) until the user chooses and assigns the appropriate alias. That icon would have no meaning by itself. It would acquire a meaning by being associated with some message or set of messages: a) an attribute testimony (signed by someone with known authority to specify such an attribute -- the equivalent of a certificate) b) a set of messages signed by the key in question (tying the key to the source material from which the user formed his/her impression of the sender) I, the user, would want to be able to call up the set of defining messages for any key or alias at any time in the future -- just in case I get so many aliases that I forget who one belongs to. > The other issue is how much time and energy the user has to spend >keeping the alias database up to date. There is no way to communicate >securely with anyone who's not in the database. If the user is >communicating with a large number of people, then it's very tempting to >get sloppy. I keep a fairly large database of aliases already, in my .mailrc on UNIX. Eudora permits a similar DB. So do a number of other mailers. Users must be demanding this feature and using it. All I say we have to add to that is protection from tampering. > There's no way around it. This kind of system will not make it in the >big time. I wouldn't be so quick to dismiss it. > As I see it, any system that does must have the following >properties: > > * Some variant on the Web of Trust. Of course -- you have to have some means for communicating and recording attributions (that the person who owns a key is allowed to spend money on a given bank account; that the person who owns a key goes by the name Carl or receives mail at cme(a)acm.org; that the person who owns a key is a trusted developer of PGP; ...). > * Online key-servers for getting keys in real time. > * A clean mechanism for validating keys through alternate channels. These two have to go together -- but I'm curious what anyone means by "validating keys". I see this as the flaw killing certificate structures like X.509 or PGP's. [Even Steve Kent, a major X.509 advocate, seems to see this problem (with sadness, in his case).] I had a secretary once, long ago. I would drive her home from work occasionally -- or to parties -- when her husband wasn't around or wasn't interested in going someplace. One time, in passing, he noted that this arrangement was OK with him because he "trusted her". I trusted her, too. I knew her to be having affairs with various people (not me at the time) but he didn't. So we each trusted her but what we trusted her to be was different. Just saying that we trusted her wasn't saying anything. As soon as you qualify the "validated key" (e.g., to be allowed to spend money, etc.), you get to the signed attributes which I advocate over certificates. If all you do with the validated key is tie it to a text string which purports to specify a human being, as X.509 or PGP do, you haven't done anything for me. If all humans had unique names, then this might mean something to me (assuming I knew the human in question and knew his unique name). However, that's what killed X.509 -- the need for unique names. We don't have them and we're not about to adopt some new social structure which assigns them. Even if we did all adopt unique names, you postulated a *large* set of people to communicate with -- larger than my immediate circle of acquaintances, presumably -- so even a unique name would be meaningless to me because I would not have met the person in question. If the unique name certificate works at all it's because I have some mechanism (not mentioned in the certificate hierarchy design) for attaching attributes to the named person. However, if I haven't met the person in question, I don't have that mechanism already and it needs to be created alongside the certificate mechanism. I don't need testimony about the name (unique or otherwise) of the person who owns that key. I need testimony about the attributes of that person (PGP developer; fellow Cypherpunk; FBI agent; undercover NSA plant; permission to use a checking account; receives mail at xxx(a)yyy.com; ...). That testimony can be provided by referencing the key itself, rather than some (artificially unique) name which exists only to link the attribute to the key. The S/W which links these together and lets me find the various testimonies for a key has to be convenient -- but that was your original point and I concur. I object only to the implication that current certificate hierarchy thinking gets us closer to that goal than the direct signed attribute statements would. > There are three possible outcomes: we build it, the NSA builds it, or >Microsoft/Netscape builds it. This last outcome might not be so bad, but >only in the first one can we rely on our principles being advanced. Amen! - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLtON1QXJENzYr45AQGiEwP+OpETJDPJ8rWbur4oH/PCZqKWtXmzTquV 4QIwoZlXoK6RnZ60szR/qqPxjnj+TtsO8FOQK5lWurv+FG67ma5PfyNbxU+WFapY uxwop8Ivb3bw0uFT2oh2VE5owAYFkmqz7kd7GleEG33dGOUz7jSELugzL4Ag8zRF 40qPwsU7B08= =aeKx - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLtOvVQXJENzYr45AQH5RQP+JroFSz3bJapOGEqA2pfhZ1dn9d7VDEUd h/JLbhFkgYbzMGsVzpu20Ww0uOsOwxQR2ItLkaSlTG0O76rgATE2Cma9LEvdoque LMgN/xg0GmaSHoecHLuKJxRz/1xreKODuai2FvndyjspfgO/H6zrQOfhsWn3qa6a ZqnNaEY+kXw= =cuUk -----END PGP SIGNATURE-----

2 2

Aware's radiation detector
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

This month's Scientific American has an ad by Aware for that serial port radiation detector we were discussing a while back. Upper right corner of page 109, I think. Sells for $149 US, 45 day money back guaranty.

2 1

e$: Moof! (Hettinga Speaks at Apple)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

God help us all. I've been invited to the CyberDog Coding Retreat next week at Apple Computer in Cupertino. Getting flown out there is cool. Hanging with the more clueful Mac Internet types and getting to kibbitz and watch (I like to watch!) them code OpenDoc parts for the internet from 8AM to midnight plus, subsisting on Dew and Pizza is really way cool. Even getting some mac.cypherpunks in the door to code cypto parts is extremely cool. But... They've asked me to give a "talk". All by myself. In an auditorium. With an audience, I mean. With publicity. I feel like Hoffman in Rain Man... V-E-R-N, Verrrn... More to the point, I feel like I'm tempting fate, here... Sooo. I've been told I can have friends in the audience. That's cool. As many friends as I want. That's even cooler. I can even have reinforcements up on the rostrum. That's extremely cool. So, while I work on the "reinforcements up on the rostrum" part, *please* come and help me explain this stuff to the rest of the Apple community. I've appended the actual poster copy, with the relevant details, below. The poster, and its copyright-violating picture of Grommit the Dog are also found on the web at: http://thumper.vmeng.com/pub/rah/talk.html Cheers, Bob Hettinga ----------------------- Geodesic Software and Financial Cryptography for Dogs Robert Hettinga 12 PM, Dec 6th 1995, Town Hall, R&D4 Robert Hettinga (really, nobody you ever heard of), will talk about the internet as a geodesic network and information surfactant, about OpenDoc as geodesic software and code surfactant, about really frightening stuff like strong cryptography on public networks and the four horsemen of the infoclypse, about digital cash and bearer certificates, and finally, about why teaching CyberDog how to do financial cryptography is so important. See this 350lb guy jump up and down and blather on for at least an hour about anonymous transactions, about the disappearance of the capital markets as as we know them, the rise and fall of the pyramid as communication metaphor, and how to raise Bucky Fuller from the dead. Learn why you should teach your code to surfact any application "suite" into little bitty pieces, to send you cash in the mail no matter where you are, and to make the whole status quo (everywhere!) disappear in a cloud of self-organized chaos. Cryptoanarchy. Right here in Cupertino, folks. See you there... ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Elliptic curves, patent status?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 27 Nov 1995 23:16:10 -0800 jamesd(a)echeque.com wrote: >At 05:16 PM 11/28/95 -0400, Michael Smith wrote: >> >> I'm unclear about the patent status of elliptic curve >> systems. Are they covered by the Diffie-Hellman patent? >> That is, is the lnguage of this patent broad enough to >> cover _all_ public-key systems, regardless of their >> mathematical basis? > >No, but RSA will litigate you with the objective of >inflicting extravagant legal costs regardless.

1 0

Re: Elliptic curves, patent status?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 27 Nov 1995 23:16:10 -0800 jamesd(a)echeque.com wrote: >At 05:16 PM 11/28/95 -0400, Michael Smith wrote: >> >> I'm unclear about the patent status of elliptic curve >> systems. Are they covered by the Diffie-Hellman patent? >> That is, is the lnguage of this patent broad enough to >> cover _all_ public-key systems, regardless of their >> mathematical basis? > >No, but RSA will litigate you with the objective of >inflicting extravagant legal costs regardless. Does the patent create any headaches for elliptic curve research or publishing elliptic curve papers, or just for new products? Dan

1 0

(fwd) Like FV with Crypto ... 'Cept Different ...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text To: www-buyinfo <www-buyinfo(a)allegra.att.com> From: Andrew Barrett/CheckFree Corporation <Andrew_Barrett(a)checkfree.com> Date: 28 Nov 95 9:32:28 EDT Subject: Like FV with Crypto ... 'Cept Different ... Mime-Version: 1.0 SAN RAFAEL, Calif., Nov. 22 /PRNewswire/ -- SBT's Internet Division today announced that its electronic storefront package, WebTrader 2.0, will integrate with Checkfree's credit card processing service providing a complete, secure Internet commerce solution. The combination of SBT's WebTrader and Checkfree's Electronic Payment Processing service allows any company to sell products on the Internet, automate order entry and fulfillment and receive credit card payments electronically. <SNIP SRC="blah, blah,blah">PR balloon deflated</snip> The Internet commerce solution process will be initiated by a merchant contacting an SBT Internet Business Consultant (IBC) who will install and configure Web Trader and provide the client with the Checkfree Merchant Application package. The IBC will arrange for a Checkfree account manager to be assigned to the account who will assist with the application process. The IBC will then customize and modify the Web Trader application, and tailor Checkfree's processing to the merchant's specific needs. Once the application has been processed and approved, the IBC will coordinate site testing for credit card transactions. At that point the merchant is equipped to conduct business on the Internet. WebTrader is the most widely-installed Windows program that allows businesses to create an electronic storefront with order forms for products or services on the Web. It automatically processes the orders and sends the customer confirmation via e-mail. WebTrader initiates and completes the sales process by providing a direct, instantaneous connection between vendor and customer, RSA Data Security's encryption software which keeps credit card numbers and other sensitive data private once it is received by the vendor's Web server. WebTrader includes several HTML templates for home pages and sales order forms that are ready to run on the Web. When a customer on the Web completes a form, the information is sent to the vendor via Internet e-mail. The vendor employs an integrated e-mail parsing program that automatically transforms the message into a standard SBT Sales Orders' bid. After the bid is authorized, it is converted to a firm order and an e-mail message confirming receipt of the order is sent via Internet to the customer. WebTrader also includes the ability to capture and track other critical business information such as sales leads, product registration and customer surveys. WebTrader can be used as a stand-alone Internet application or in conjunction with SBT's Pro Series 3.0i accounting software. WebTrader has a suggested retail price of $1,295. ->Finger abarrett(a)ee.net for Keyprint ->Public Key Coming Soon to a Keyserver Near You! --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Archives?
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

On Tue, 28 Nov 1995, Anonymous wrote: > Is this list archived so that I can try to look stuff up before asking > stupid questions? <http://www.hks.net/cpunks/index.html> You can run lycos searches on its contents.

1 0

Re: Elliptic curves, patent status?
by smithmi＠dev.prodigy.com 17 Dec '03

17 Dec '03

I'm unclear about the patent status of elliptic curve systems. Are they covered by the Diffie-Hellman patent? That is, is the lnguage of this patent broad enough to cover _all_ public-key systems, regardless of their mathematical basis? --Michael Smith smithmi(a)dev.prodigy.com

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Is this list archived so that I can try to look stuff up before asking stupid questions?

2 1