- cypherpunks-legacy - lists.cpunks.org

Re: PGP Mailer for the masses ?
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: provos(a)wserver.physnet.uni-hamburg.de, coderpunks(a)toad.com, cypherpunks(a)toad.com Date: Fri Aug 09 15:56:37 1996 Niels, Thanks, for describing the features of Pronto Secure :) This is how Pronto Secure matches up to your checklist: > Here is just a short list what such a programm should be able to > do: ( all options should be optional ;) > > Sending Mail: > - Clear signing of outgoing mail YES > - If public key of recipients is known encrypt with those keys YES > - If there is access to a public keyserver try to get a public key > for the recipients YES > Receiving Mail: > - While reading mail ( similiar to premail ) try to check existing > signatures if public key is available otherwise try to get > public key from server YES (do on the fly signature checking as mail arrives in inbox) > - Traverse the web of trust and show how the public key is > related to one own keys to mutual signatures on other public keys > ( For example mean distance to a key signed by the recipient > himself ) NO (we handle certification by allowing the user to modify a list of trusted certifiers for signing keys) > - If the mail contains a public key add it to the keyring NO (Key is shown as an attachment icon double click on it adds it to the keyring) > - Don't show pgp blocks in Mail since they might confuse YES > Keymanagement: > - Should be integrated in the addressbook together with E-Mail > Address and name. YES > - Keys should be imported via generation or via mail or via a file YES (or the clipboard) > - If you have a public key without an entry in the addressbook > take the EMail and Name from the public key YES (or prompt user to supply address) > - One should be able to sign the keys during import if origin is > known NO (signing keys is a separate process. This gives the user an opportunity to authenticate on another channel) > Misc: > - Passphrase should be kept in memory for a definable time, 0 for > immediate deletion, thus you would be prompted for the passphrase > each time you use it. Question about Windows Swapspace ? or tag the > memory as uncacheable ? NO (Keyboard sniffing is too easy to do in Windows, This would give a false sense of security) > I would suggest creating a library with seperate io and gui parts in > order to motivate peeple in helping who do not want to support > mainstream products like Windows. Like taking the PGP 3.0 lib ( is it > out yet ?) and modify it a bit. YES (Separating UI from security functionality is also the right way to go for offering plug in security providers) > Since there are a variety of good functioning mailers available > already it wouldn't make sense developing the whole stuff but instead > only integrate the library into existing products. NO (It will not be an easy task to design a general library of UI elements that any mail client will be able to seemlessly plug into.) > Do you think that such proposal is senseable and that there are > people who would be willing to support the idea with programming > affords ? It exists. Plus a few additional features not mentioned, and a much longer wish-list in the process of being implemented. Check it out. It is available from http://www.commtouch.com/p1.htm IMPORTANT: COMMTOUCH WILL GIVE A FREE COPY OF PRONTO SECURE TO ANY MEMBER OF THE CODERPUNKS/CYPHERPUNKS LISTS SUPPLYING USEFUL FEEDBACK ABOUT THE PRODUCT. The impressions of early users of Pronto Secure can be viewed at: http://www.commtouch.com/testers.htm (many of whom are list members) Regards, Geoff. - --------------------------------------------------------------- Geoff Klein, Pronto Secure Product Manager; www.commtouch.com My PGP public Key 1814AD45 can be obtained by sending a message to geoff(a)commtouch.co.il with "Get PGP Key" as the subject. - ---------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMgs1ikLv5OMYFK1FAQGe/gP/RdXtVIwo7aupkJn6X4VNTuNHHymPf9fJ k7FAsONAAP9qbr4UaWzJXxWuvmxLgt5gsMpk6yzp6vY80krQqPf6SqphW7FOjGTq PB05bNLDHm9SRGjVvKRHzGbOr094gkFpeso2C3MeMiDbT0J5gsLJOeMJsIb4NW2A lHZ6e+o535w= =R2jc -----END PGP SIGNATURE-----

2 1

Re: Tim's Mac Tales
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Thaks to Tim for politely noting that I alfingered most admirable Gordon Moore as mal intendu Intel-inside wheeler-dealer. That's actually Andy Grove, el supremo maestro of Intel intel despicably untellable -- except to those deep, deep inside black budgeteering. A crank SciFi fantasy, to be sure, long ago, and well into the intel futures, disproven. Like NASDAQ never cheats consumers.

1 0

Re: Oregon License Plate Site in the News Tonight!
by Bill Stewart 17 Dec '03

17 Dec '03

Cypherpunks, Aaron - >> I'm watching the LA NBC news channel, and they report that the Oregon "look >> up any license plate" Web site is causing a flap. Though apparently legal, >> the critics admit, the Governor wants the material removed. ( Aaron Nabil's page is at http://www.i.net/cgi-bin/plates , but temporarily won't give you license plate information.) A nice touch, at least for now, would be to put up some propaganda about "The State of Oregon sells your license plate information to anyone who wants to buy it. Big companies have it. Small sleazy companies have it. Tax collectors have it. Car thieves and burglars can buy it if they want. Everybody but _you_ has it -- I've put it on the net so you can have it too. If this bothers you (and maybe it should), don't complain to the governor about it being on the web - complain that the State is selling your private data. I've taken the server down temporarily, but press HERE for the Governor's info, HERE for Senator Hatfield (AAA001), and HERE for the DMV head bureaucrat?" If you want to get fancy, you could have the search return a FOUND / NOT FOUND record, so people could check for vanity license plates (if Oregon has them), or search for well-known politicians' information. The data's there; it's just a matter of crunching it. "Big Bro knows License Plate AAA001, Mr. M. H. " "Big Brother doesn't know License Plate AAA" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

photographed license plates
by i am not a number! 17 Dec '03

17 Dec '03

At 21:55 8/8/96, i am not a number! wrote: >CBS radio news this morning: 80,000 commuters traveling the central >f'way in SF will have information mailed to them regarding the quake >retrofit blah blah. > >How? Their license plates have been photographed. >... and the cheery "news" anchorwoman sweetly moved on to the next >story..... >> You *are* making this up, right? Please say you did. ------------------------------------------ I AM NOT making this up, unfortunately. The news story contents may be bolluxed, of course, maybe they got it wrong. But this is what she said, no joking. O, and I think they're talking more about putting up cameras at some troubling intersections to take pictures of cars running red-lights. And cameras on transit vehicles (buses primarily). Gee, I am starting to feel so warm and safe!

4 3

Re: Why should we trust the system?
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> wrote: >When supporting plans like GAK ("key escrow") and wiretaps... <snip> >If we allow this fiasco to die without a full analysis, >particularly in light of the government's repeated assurances >with regards to search warrants, we will be as incompetent as >the police were. Further, my original question, phoned in anonymously to the FBI, mailed in anonymously to this list, and asked to the media (I guess I like wasting my time) has never been either asked or answered. I will restate it in stronger terms: "Why the hell, when you have a tape of the perp. saying something, do you not air it in the middle of a city chock full of people who could very well know this guy's voice/mannerisms?" Why didn't the media ask for it, and then give the answer (the fibbieclerk had no answer at all for me) the FBI gave?? Am I missing something? We hear 911 tapes ALL THE TIME of various stuff happening. Has the FBI suddenly become a bunch of civil liberties activists WRT the privacy of terrorist bombers? Just asking. me

2 1

Re: Going Postal (Was: Boom!)
by David.K.Merriman＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Fri Aug 09 10:12:37 1996 > The Post Office has now jumped on the terrorist bandwagon by > announcing that it will no longer be legal to drop any package > weighing over 16 ounces into a collection box. > ... > > I suspect one could do a lot of damage to a mailbox with under 16 > ounces of the proper explosive. Perhaps one of our resident > Cypherpunks bomb experts could expand on this subject. Don't know that I'm a 'bomb expert', but it would appear reasonable that 6 just-under-a-pound bombs would do approximately as much damage as a similarly sized larger device. Even if the 6 devices got scattered to two or more aircraft, the terror factor would be significant Dave Merriman - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCUAwUBMgqeo8VrTvyYOzAZAQFGfAP3ZL7pgWjadNN93mtwdG4cm60VjGcdP4G9 JlwS96gs6QJ0lD1CImMQL82KUIYe1IpPidC3bq5kTQhGbdM69yFiUmCxOGNwnH1L pEbeEZ/OGDf0bnk/BYhoRKp1ufgdTVVSB1T0WZEYIaLe2zX1zzQPli4LW4UPUrds 5tmjt4QMEg== =AZ0H -----END PGP SIGNATURE-----

1 0

Crypto Interface in Netscape
by Adam Shostack 17 Dec '03

17 Dec '03

Is it just my windows machine or are the security dialogs in Netscape3.0b6 completely unreadable? I get a dithered grey background behind black text. Can'tread the dialog boxes that show up when I see a new cert. (Speaking of which, there seems to be a new long list of acceptable CA's. Has Netscape published a policy doc explaining how Adam's Quik & EZ CA can get on the list? And, those CA's should have hyperlinks, so I can easily find their policies for key signing, so I can decide rationally that I don't trust the Post Office to certify things. Right now, its just a gut feeling that they can't be trusted. "Please don't call them junk certificates.") Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Oregon License Plate Site in the News Tonight!
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:23 PM 8/8/96 -0700, Timothy C. May wrote: >At 2:49 AM 8/9/96, John F. Fricker wrote: > >>Isn't that the role of legislation? To implement solutions that society >>would not do on it's own? >> >>The enabling technology is obviously off the self. >> >>I think you may have misinterpretted my last sentence which was supposed to >>have had a ? at the end. Where's the proof reader when you need one! > >"To implement solutions that society would not do on it's own?" > >Would not do, or could not do? It is within anyone's power to ask their >psychiatrist what form of encryption he uses to protect his files. Likewise >with doctors and hospitals. > Well where there's a will there's a way. I agree that the general public and the market place often lacks the power to affect particular events. Central planning can facility certain processes. Free-marketers may argue that I can query and select based upon my encryption criteria but chances are my psychiatrist will do nothing more than "make note" of paranoia and ponder it's significance: "Do you resent your mother?" >(Though I freely admit that one would not be likely to get very far. For at >least the next decade or two, the reaction will likely be "Huh?" But >"legislation" mandating a form of encryption is not the answer. For many >reasons.) > >On this list at least, calls for passing laws to implement societal >solutions are not usually smiled upon. This is not to say such discussions >are out of bounds, only that you'd better make some persuasive arguments >and not just appeal to our common sense sympathies for social engineering >and more laws. I am not a great fan of social engineering and regulations. Yet the legisture in Oregon may get called for a special session to address this issue and I see this an opportunity for a grander arguement than merely acccess to the DMV data. And as much as we dislike the presence of the governments they do indeed exist. Living within their domain limits our choices to either: complacency through inaction (cynicism et al), attempts at isolation (back to the land), or taking an active role through voting, education, civil disobedience or participation in the process (a pox on party politics! the latter choice is easily the least enticing while civil disobedience can be truly fun! >g<). Ok so call me a statist and shove me out the door, but I am not argueing for the existance of a state. It does currently exist and I am not self-sufficient. But I digress. So. #1) My state legislature may very well get called to address this issue. Do they have any concept of the big picture here? That the DMV data is one small part of a debate regarding privacy which needs to be addressed. This is an opportunity for some education and by the end of the day I should know if my representatives are willing to listen. #2) The records industry (for lack of a better term to encompass all companies that accumulate data on individuals) needs some standards and guidelines. Or walls and fences. Maybe even bars and a moat! And the sooner the better. Federally imposed software requirements are not uncommon in certain industries. It is time for standards for the personal data maintained by co-operating entities (ie agencies the public co-operates with such as doctors, the DMV, and so on). #3) The goal is the anonymous citizen. The first step it to secure the data currently exposed. Can this be done _without_ legislation? --j

2 1

SecurID
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

someone at my firm is about to press the securid system down our collective throats. please point me to the recent thread on this subject, and/or point me to some url's or the like, or to someone who has some firsthand knowledge of the pitfalls and/or vulnerbilities of secirid. cheers, -paul

3 2

Re: Why should we trust the system?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:19 PM 8/9/96, Anonymous wrote: >Further, my original question, phoned in anonymously to the FBI, >mailed in anonymously to this list, and asked to the media (I >guess I like wasting my time) has never been either asked or >answered. I will restate it in stronger terms: >"Why the hell, when you have a tape of the perp. saying something, >do you not air it in the middle of a city chock full of people >who could very well know this guy's voice/mannerisms?" Why didn't >the media ask for it, and then give the answer (the fibbieclerk >had no answer at all for me) the FBI gave?? Am I missing something? >We hear 911 tapes ALL THE TIME of various stuff happening. Has the >FBI suddenly become a bunch of civil liberties activists WRT the >privacy of terrorist bombers? >Just asking. This is the single best suggestion/question I have heard about this entire case! Why, indeed, has the 911 threat not been aired publically, where someone might recognize the voice as being that of their brother, or boss, or whatever? And might hear immediately that whomever it is, it ain't Richard Jewell. If any of you cyber-journalists who hang out here in the wings on Cypherpunks, collecting material for stories, are reading this, please ask your journalists covering the Atlanta bombing about this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1