- cypherpunks-legacy - lists.cpunks.org

Re: What email encryption is actually in use?
by Dave Howe 02 Oct '02

02 Oct '02

James A. Donald wrote: >> And PGP tells me "signature not checked, key does not meet > validity threshold" what version are you on? ckt never does that - it checks it, and marks the sig status as good or bad - but obviously marks the key status as invalid (due to lack of signing) on anyone I don't trust enough to sign :) oh - and some versions of pgp have trouble with that particular key - its a 4K RSA that V5.x would accept, but V6.x wouldn't Try 6.5.8 CKT instead :)

2 1

RE: What email encryption is actually in use?
by Lucky Green 02 Oct '02

02 Oct '02

Ben wrote: > Lucky Green wrote: > > I also agree that current MTAs' implementations of STARTTLS > are only a > > first step. At least in postfix, the only MTA with which I am > > sufficiently familiar to form an opinion, it appears impossible to > > require that certs presented by trusted parties match a particular > > hash while certs presented by untrusted MTAs can present any > > certificate they desire to achieve EDH-level security. > > This is probably a stupid question, but... why would you want > to do this? To protect against MIM attacks on the encrypted tunnel between the trust domains represented by my friend's MTA and my MTA. --Lucky Green

1 0

Re: JYA ping
by Eugen Leitl 02 Oct '02

02 Oct '02

On Wed, 2 Oct 2002, Anonymous wrote: > Cryptome has nor been updated since 9/23 ... any clues, anyone ? No. Anyone knows whether John Young is okay?

1 0

Re: What email encryption is actually in use?
by Adam Shostack 02 Oct '02

02 Oct '02

On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: | Lucky Green wrote: | >I also agree that current MTAs' implementations of STARTTLS are only a | >first step. At least in postfix, the only MTA with which I am | >sufficiently familiar to form an opinion, it appears impossible to | >require that certs presented by trusted parties match a particular hash | >while certs presented by untrusted MTAs can present any certificate they | >desire to achieve EDH-level security. | | This is probably a stupid question, but... why would you want to do this? So that your regular correspondants are authenticated, while anyone else is opportunisticly encrypted. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: What email encryption is actually in use?
by Major Variola (ret) 02 Oct '02

02 Oct '02

The problem Mr. Howe describes is fundamental, folks: encryption should be end-to-end even when the endpoints are functionaries in a company. Because not all employees are equal. So yes Alice at ABC.COM sends mail to Bob at XYZ.COM and the SMTP link is encrypted, so the bored upstream-ISP netops can't learn anything besides traffic analysis. But once inside XYZ.COM, many unauthorized folks could intercept Bob's email. Access Control is sorely lacking folks. Link encryption is a good idea, but rarely sufficient. At 01:20 PM 10/1/02 +0100, David Howe wrote: >at Tuesday, October 01, 2002 3:08 AM, Peter Gutmann ><pgut001(a)cs.auckland.ac.nz> was seen to say: >> For encryption, STARTTLS, which protects more mail than all other >> email encryption technology combined. See > >I would dispute that - not that it isn't used and useful, but unless you >are handing off directly to the "home" machine of the end user (or his >direct spool) odds are good that the packet will be sent unencrypted >somewhere along its journey. with TLS you are basically protecting a >single link of a transmission chain, with no control over the rest of >the chain.

5 5

Lose up to 10 pounds FREE with TrimLife!
by quickclickbingo 02 Oct '02

02 Oct '02

Dear , Trimlife is so sure that you can lose 5-10 pounds in 7 to 10 days we want to send you a 7-day supply of our amazing Herbal Weight-loss tablet FREE. Click Here to Get Started! http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/ <a href="http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/"> AOL Users Click Here</a> That's right, you read correctly, we want to send you a FULL 7- DAY SUPPLY FREE! Well also give you your own Personal Weight-loss Counselor to provide you with lots of Health and Weight-loss tips and secrets daily! And, Well even send you the link to our fabulous new TrimLife E-Book 101 Top Secret Fat Burning Recipes Tips, Tricks, and Much More! - The book is a $39.95 value, Its yours FREE. All you pay is the mailing cost of One Dollar. Don't let Just $1.00 stand between you and melting off 5-10 pounds in 7 days. How do you get this FREE SAMPLE? It's easy! Just click here. Thanks! Click Here to Get Started! http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/ <a href="http://www.quickclickbingo.com/maaayGvaaTMQLbaSzWRb/"> AOL Users Click Here</a> ==================================================================== Update your profile or unsubscribe here: http://topica.email-publisher.com/survey/?a84EO7.baSzWR Delivered by Topica Email Publisher, http://topica.email-publisher.com/

1 0

Re: What email encryption is actually in use?
by pgut001＠cs.auckland.ac.nz 02 Oct '02

02 Oct '02

"David Howe" <DaveHowe(a)gmx.co.uk> writes: >at Tuesday, October 01, 2002 3:08 AM, Peter Gutmann ><pgut001(a)cs.auckland.ac.nz> was seen to say: >>For encryption, STARTTLS, which protects more mail than all other >>email encryption technology combined. See >>http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix02_slides.pdf >>(towards the back). >I would dispute that - not that it isn't used and useful, but unless you are >handing off directly to the "home" machine of the end user (or his direct >spool) odds are good that the packet will be sent unencrypted somewhere along >its journey. with TLS you are basically protecting a single link of a >transmission chain, with no control over the rest of the chain. As opposed to more conventional encryption, where you're protecting nothing at any point along the chain, because 99.99% of the user base can't/won't use it. In any case most email is point-to-point, which means you are protecting the entire chain (that is, if I send you mail it may go through a few internal machines here or there, but once it hits the WAN it's straight from my gateway to yours). Peter.

3 2

Sunshine and Mickey!
by michelle7007149＠yahoo.com 02 Oct '02

02 Oct '02

1 0

Re: What email encryption is actually in use?
by David Howe 02 Oct '02

02 Oct '02

-----BEGIN PGP SIGNED MESSAGE----- at Tuesday, October 01, 2002 9:04 PM, Petro <petro(a)bounty.org> was seen to say: > Well, it's a start. Every mail server (except mx1 and > mx2.prserv.net) should use TLS. Its nice in theory, but in practice look how long it takes the bulk of the internet to install urgent patches - how long is it going to take to get people to install an upgrade to privacy that actually causes more problems for them? Besides the core here is that 1) everyone with a server enroute can read the mail 2) you are relying on every other link in the chain to protect your privacy clientside crypto fixes both these problems, reduces the total crypto load on the chain (encryption/decryption is only ever done once) and allows use of digital signatures. > Once you start using it, it becomes part of hte pattern by wich > other people identify you. Exactly the intention, yes :) Just for the sake of it (anyone who cares will have seen my signature enough times by now) I will sign this one :) -----BEGIN PGP SIGNATURE----- Version: PGP - Cyber-Knights Templar iQIVAwUBPZqzpWDKt9Hjj5SVAQFlwA//cQYGFRb3sJEM695lWJ+rUhymcS5lTSEV vG3eRUvxpbhLcAS+QsdMXX3pDlu60UzOhxubpQch9E59yE/+uaeU+5AzkfDQjc2q jQ8SppCqf56+uevoZlH1RiKkBT6Hx7ctPimEIlq3FXWsaqA3ocPVghZwFhMaxA1G twCtBxR7Q3y6VePzCzeealx7TDgcoS7hoBKNTsueAIWd/9xB9JYjFvS8OecOMdZG B+yvSLHZn1YJG62JfZ8EWXr1xKh5BZxdRVxLVzhaumtyAFr2hCDQffDiz5UtyGSa JdMoJAzmZZZ5EvcHc0rMDVs5BiDr5/EaSU+xecPz/YxY4BWxGFprqsRi7IapTkb1 26zgJQ4miGylFlmZM30cxKYudi5PdSJ4VUWpuoHRg9clZlH9KzC7f0suYAnACDXC bzr5Fgp3+bvRnziMD65NT4G1hxA5pYPl+4IudVSKcaMsHLWSTE8Lnf0US283MdeR VXKbINvyEr0p0zrl7lVmHZbmuLjdUHrgAoyQEKcaMelE+Q8suXynDYtSV7LCfdAE CjKBz2RxAiNhi1vAq6NuFOMx+R9c23Sxg2uUUbpYeRbl5fPbjamDzIhK2ccNNmpU euuWj3O9e6YMtW0KPezYbJ/9fMMkOAv3KnfdeAgcjSnipMqVvqgJ4sWil3gfUADY X0TKznTghWs= =3uOF -----END PGP SIGNATURE-----

1 0

Re: What email encryption is actually in use?
by David Howe 02 Oct '02

02 Oct '02

at Tuesday, October 01, 2002 6:10 PM, James A. Donald <jamesd(a)echeque.com> was seen to say: > Not so. It turns out the command line is now different in PGP > 6.5.8. It is now pgp -sta to clearsign, instead of pgp -sa. > (Needless to say the t option does not appear in pgp -h *nods* its in the 6.5 Command Line Guide, but as "identifies the input file as a text file" The CLG is the best reference for this though - as it explictly lists sta as the correct option in section Ch2>Common PGP Functions>Signing Messages>Sign a plaintext ASCII file. I could email you a copy of the PDF of that (its about 500K) if you wish. > The clearsigning now seems to work a lot better than I recall > the clearsigning working in pgp 2.6.2. They now do some > canonicalization, or perhaps they guess lots of variants until > one checks out. its canonicalization - again according to the CLG (CH3>Sending ASCII text files to different machine environments) > Perhaps they hid the clear signing because it used not to work, > but having fixed it they failed to unhide it? its just an evolution. IIRC the command line tool was based at least partially on the unix version of pgp, which always had different command line switches. It would be nice if behaviour was more backwards compatable, but they *did* document it in the official M that you should RTF :)

1 0