- cypherpunks-legacy - lists.cpunks.org

RE: Sending bricks through the mail
by Thoenen, Peter Mr. EPS 03 Nov '02

03 Nov '02

Tried emailing direct but bounced so apologize to the list for the OT content :) You don't happen to have the url do you? Think it would make an amusing read. -Peter > -----Original Message----- > From: Major Variola (ret) [mailto:mv@cdc.gov] > Sent: Sunday, November 03, 2002 18:37 > To: cypherpunks(a)lne.com > Subject: Sending bricks through the mail > > > At 09:37 PM 11/2/02 -0800, Tim May wrote: > >When I was at Intel we sent our designs for microprocessors > to European > > >branches and/or partners. One set of designs sent to MATRA/Harris, a > >partner in the 80C86, was stolen in transit. (The box of > tapes arrived > >in Paris, but the tapes had been replaced by the suitable weight of > >bricks.) > > There exists a website by someone who enjoyed sending unusual things > through the US mail. He once sent a brick, with proper postage, > no envelope. > > The brick *eventually* arrived at its destination, sort of, > but had been > broken > by the DEA according to the PO's paperwork.

1 0

RE: Sending bricks through the mail
by Thoenen, Peter Mr. EPS 03 Nov '02

03 Nov '02

<--smax self :) > -----Original Message----- > From: Steve Furlong [mailto:sfurlong@acmenet.net] > Sent: Sunday, November 03, 2002 23:28 > To: cypherpunks(a)lne.com > Subject: Re: Sending bricks through the mail > > > On Sunday 03 November 2002 17:17, Thoenen, Peter Mr. EPS wrote: > > Tried emailing direct but bounced so apologize to the list > for the OT > > content :) > > > > -----Original Message----- > > > From: Major Variola (ret) [mailto:mv@cdc.gov] > > Peter, you might want to google on "variola major" (not "major > variola"), note Maj Variola's alleged host, and consider the > possibility it's a nym. > > -- > Steve Furlong Computer Condottiere Have GNU, Will Travel > > Vote Idiotarian --- it's easier than thinking

1 0

Integrated crypto sounds useful, but it's fragile and ultimately a lose
by Tim May 03 Nov '02

03 Nov '02

On Sunday, November 3, 2002, at 12:19 PM, Tim May wrote: > As with the situation a decade ago, there are: > > * several OSes in use (2-3 in Wintel world, 2 in Mac world, plus > outliers) > * various release versions of each > * about 5-8 major mail programs covering these platforms > * about 3-5 major newsreader programs And I forgot to mention Linux... Anyway, this is "tower of Babel" situation we have always faced with trying to tightly integrate crypto with apps and OSes. > Several times over the past decade I have heard people urge others to > change their mailer to one that is supported. > > This is even worse than "not one-click operation," as it asks users to > abandon programs and OSes they like or need in order to obtain a > marginal gain of sending a receiving encrypted messages with one click. To expand on this point a bit, I suspect one of the main reasons people who once used PGP stop using it, either privately or at corporations (as we have heard folks here testify about), is because something changes and things "break." They upgrade their OS, they get a new release of a mailer, and things break. And they don't have the time, energy, or inclination to track down all of the little gotchas that may have cause things to break. I know this happened to me several times over the years with various versions of PGP, Eudora, and Mac OS 7, 8, and 9. And I expect that if and when I upgrade my OS, or Mail program, and PGP breaks, I'll be without PGP until it all becomes straightforward again. Expecting people to use mailer and OSes other than the ones they already use just so they can get a bunch of "Hey, isn't this PGP rilly cool?" unsolicited messages is silly. (Which is why, to harp on it, I would favor a very clean text-only approach. Then there would be a slight amount more work needed, but not the breakage we see.)

1 0

Sending bricks through the mail
by Major Variola (ret) 03 Nov '02

03 Nov '02

At 09:37 PM 11/2/02 -0800, Tim May wrote: >When I was at Intel we sent our designs for microprocessors to European >branches and/or partners. One set of designs sent to MATRA/Harris, a >partner in the 80C86, was stolen in transit. (The box of tapes arrived >in Paris, but the tapes had been replaced by the suitable weight of >bricks.) There exists a website by someone who enjoyed sending unusual things through the US mail. He once sent a brick, with proper postage, no envelope. The brick *eventually* arrived at its destination, sort of, but had been broken by the DEA according to the PO's paperwork.

1 0

Re: Katy, bar the door
by Major Variola (ret) 03 Nov '02

03 Nov '02

At 10:49 AM 11/2/02 -0800, Bill Frantz wrote: >(A number of years ago, there was a case where a >pilot, presumably asleep, flew right past Los Angles, over the Pacific >ocean, and crashed. ATC was very concerned, but couldn't do anything to >wake the pilot.) Around a year ago a small private jet lost contact over the US. A jet was dispatched, saw iced windows, no response to signals. The plane was on autopilot, eventually crashed in the middle of nowhere. The passengers/pilot are believed to have passed out from anoxia. (The autopilot kept them at high altitude too!) When that trucker kamakazi'd into the state capital in Sacramento last year, they decided to put Jersey barriers up. Hard to do that in the air (Blimps with nets?)

2 1

Interesting series of articles on GCHQ, Public Key etc.
by Bo Elkjaer 03 Nov '02

03 Nov '02

List: This Is Gloucestershire has published an interesting little series of articles commemorating the GCHQ 50 years anniversary. The articles can be found at: http://www.thisisgloucestershire.co.uk/displayNode.jsp?nodeId=110560&comman… Yours Bo Elkjaer, Denmark <QUOTE> In 1965, James Ellis, who worked for CSG (GCHQ's codemaking department), went back to first principles to solve the problem and dreamed up the unthinkable. His vision was sending secret messages without the need for exchanging a key. Suppose Alice wants to send a message to Bob. Alice looks up Bob's "public" key and encodes her message using a standard algorithm. Bob receives the message and decodes it using his "private" key and another standard algorithm. Anyone can intercept the message because the public key is widely known, but only possession of the private key enables the decoding step. The private key remains in Bob's possession throughout and never has to be passed to Alice, thus guaranteeing confidentiality. By 1967 public key cryptography had hit a brick wall. Mr Ellis was not able to come up with a private key function to bring his theory to life. But in September 1973 bright young Cambridge graduate Clifford Cocks joined GCHQ. After six weeks, the puzzle was presented to Mr Cocks and within half an hour he came up with a solution - an algorithm that made Mr Ellis' theory a real possibility. In 1975, these ideas were refined further by Mr Cocks' colleague Malcolm Williamson. Because they were employees of GCHQ, they were sworn to secrecy and their brilliant idea was never made public. In 1976, a trio of American academics, Diffie, Hellman and Merkle, filed a patent for their version of public key cryptography which they developed independently. They went on to claim the glory for developing the system. </QUOTE> -- EOT

1 0

Re: What email encryption is actually in use?
by Tyler Durden 03 Nov '02

03 Nov '02

"Prior to that, the encrypted email I've sent in the past year or so has almost always failed, because of version incompatibilities," While in Telecom I was auditing optical transport gear, and we adopted the practice of encrypting all of our audit reports to vendors. Of course, the chance of there being an eavesdropper (uh...other than NSA, that is) was a plank energy above zero, but it gave the vendors the imporession we really cared a lot about their intellectual property (if we determined a problem with their equipment, and if that info ever leaked, it could have a major impact on them). That the mesages were decrypted I know for sure, and it was easy for the customers: we would verbally tell them the password for unpacking the encrypted file, and they merely typed it in a it extracted itself. I think the encryption tool was installed directly into the file manager (or whatever it's called now), so it was easy to do. >From: Steve Furlong <sfurlong(a)acmenet.net> >To: cypherpunks(a)lne.com >Subject: Re: What email encryption is actually in use? >Date: Sat, 2 Nov 2002 12:41:55 -0500 > >On Saturday 02 November 2002 12:09, Adam Shostack wrote: > > An interesting tidbit in the September Information Security Bulletin > > is the claim from MessageLabs that only .005% of the mail they saw in > > 2002 is encrypted, up from .003% in 2000. > > > > ... Last month, about > > 5% of my email was sent PGP encrypted, about 2% STARTTLS encrypted, > > and about 25% SSH encrypted to people on the same mail server, where > > POP and IMAP only function via SSH. > > > > I'd be interested to hear how often email content is protected by any > > form of crypto, including IPsec, Starttls, ssh delivery, or PGP or > > SMIME. There's probably an interesting paper in going out and > > looking at this. > >Well, here's a datum for you: in the past four or five months, I have >sent exactly no encrypted email. There are several reasons, notably >that most of my email correspondents are business types who can't >handle encryption even after several lessons and checklists and even >when the tools are integrated into the MUA. > >Prior to that, the encrypted email I've sent in the past year or so has >almost always failed, because of version incompatibilities, human >error, changes of email address, and what-not. Or because the recipient >simply isn't bothering to decrypt mail any more because it's more >trouble than it's worth for the low quality of information conveyed. > >The only business environment I've ever worked in which successfully >used encrypted email mandated specific versions of mail client >(Outlook, ecch) and PGP (integrated into Outlook), had a jackbooted >thug to make sure everyone's keyring was up to date, and had a fairly >small (couple dozen), mostly technically proficient, user base. And >even there, half the time the encrypted message wasn't sensitive enough >to be worth encrypting nor important enough to be worth decrypting. > >I have signed a few messages in the recent past, but that was probably >even less worthwhile than encrypting them. For all I know, not a single >one has been verified. > >-- >Steve Furlong Computer Condottiere Have GNU, Will Travel > >Vote Idiotarian --- it's easier than thinking _________________________________________________________________ Unlimited Internet access for only $21.95/month. Try MSN! http://resourcecenter.msn.com/access/plans/2monthsfree.asp

2 1

Re: What email encryption is actually in use?
by David Howe 02 Nov '02

02 Nov '02

at Monday, September 30, 2002 7:52 PM, James A. Donald <jamesd(a)echeque.com> was seen to say: > Is it practical for a particular group, for > example a corporation or a conspiracy, to whip up its own > damned root certificate, without buggering around with > verisign? (Of course fixing Microsoft's design errors is > never useful, since they will rebreak their products in new > ways that are more ingenious and harder to fix.) Yup. In fact, some IPSec firewalls rely on the corporate having a local CA root to issue keys for VPN access. from there it is only a small step to using the same (or parallel issued) keys for email security. The problem there really is that the keys will be flagged as faulty by anyone outside the group (and therefore without the root key already imported), and that will usually only work in a semi-rigid hierachical structure. There *is* an attempt to set up something resembling a Web of trust using x509 certificiates, currently in the early stages at nntp://news.securecomp.org/WebOfTrust > I intended to sign this using Network Associates command line > pgp, only to discover that pgp -sa file produced unintellible > gibberish, that could only be made sense of by pgp, so that no > one would be able to read it without first checking my > signature. you made a minor config error - you need to make sure clearsign is enabled. > I suggest that network associates should have hired me as UI > design manager, or failing, that, hired the dog from down the > street as UI design manager. It's command line. Most cyphergeeks like command line tools powerful and cryptic :)

2 1

cypherpunks, $5.00 per 100MG dose for Gen*ric V*agra. Limited Time Free Doctor Consultation
by Will Bandel 02 Nov '02

02 Nov '02

1 0

Re: Katy, bar the door
by John Kelsey 02 Nov '02

02 Nov '02

At 09:32 PM 10/31/02 -0800, Tim May wrote: ... >If the attackers/hijackers cannot get into the cockpit and gain control >of the plane, then the most they can do with disabling/lethal/nerve >gases is to cause the plane to essentially crash randomly...which kills >a few hundred people, but probably not many more. > >Which is yet another reason why securing the cockpit door very, very >well is the single most important, and cheapest, solution. Hmmm. I agree, but if the attackers chose the right time (while the plane's on autopilot) to release the gas or whatever, they might have an hour or two to get through the cockpit door, with no resistance at all from the now-dead passengers or crew. Securing a cockpit door in those circumstances is *much* harder than securing it against someone with a shorter time to get through, and with the possibility of active resistance from the other side. (I seem to recall hearing some pilot comment that he was very confident of his ability to keep someone from breaking through the door, just by flying so that it's almost impossible to stay on your feet. Certainly, trying to use a hacksaw or cutting torch or something wouldn't be much fun while the pilot did loops or something.) On the other hand, the pilot or copilot pretty much just have to figure out something is wrong and indicate this fact to the people on the ground, and there will be a plane along shortly to shoot them down if necessary. And I don't think this kind of gassing attack would work all that smoothly in practice--some people would be affected before others, due to nonuniformity in the way air is distributed in the cabin and different levels of susceptibility. The combination of a hard-to-break-into cockpit and some kind of response to prevent these planes being used as low-tech cruise missiles seems like a win. Maybe it would make sense to add some kind of remote surveilance of the cockpit, though I imagine this wouldn't be too popular with pilots, and they'd definitely need to secure the channel properly. >--Tim May --John Kelsey, kelsey.j(a)ix.netcom.com // jkelsey(a)certicom.com

1 0