- cypherpunks-legacy - lists.cpunks.org

Re: PGP to PC mail integration
by Mike Ingle 17 Dec '03

17 Dec '03

>Seriously, the idea here is that the pgp front end shouldn't deal with >the user interface in your present mail program. Nobody (before you) >have considered doing it completely without a user interface. Exactly. Yes, it will at least have to have a config screen. It will probably have to prompt for a passphrase on the fly, unless you want to store it. It can ask to encrypt or not, or it can have a header in the message. The important thing is I don't care about the user interface of the mail program. This has been the big barrier so far. Mike

2 1

FW: Online Cyberlaw Workshop
by blanc 17 Dec '03

17 Dec '03

FYI, for anyone here who might be interested..... .. Blanc ---------- From: Dick Moores[SMTP:rdm@netcom.com] Sent: Thursday, February 29, 1996 7:26 AM To: SEASIGI Subject: Online Cyberlaw Workshop (from TOURBUS) CYBERSPACE LAW FOR NONLAWYERS ----------------------------- Three highly respected law school professors (Professor Larry Lessig, University of Chicago Law School; Professor David Post, Georgetown University Law Center; and Professor Eugene Volokh, UCLA School of Law) have written a *FREE*, online cyberlaw workshop called, appropriately, "CYBERSPACE LAW FOR NONLAWYERS." CYBERSPACE LAW is specifically written for lay people like you and me, and the workshop's lessons use easy-to-understand English -- NOT legalese and Latin! YEAH, BUT WILL I *UNDERSTAND* IT? --------------------------------- Actually, yes. The workshop's authors really are writing CYBERSPACE LAW's lessons for educated lay people, *NOT* lawyers. I took a look at an earlier article written by one of the workshop's professors (Eugene Volokh, "Cheap Speech and What It Will Do", 104 Yale L.J.1805 (1995)), and I have to say that I am quite impressed ... although I have to say that I am quite disappointed that Volokh did not have a single Southern word *anywhere* in his article :) WHAT WILL THE WORKSHOP COVER? ----------------------------- CYBERSPACE LAW is going to help you learn the basic principles of -- and unlearn some common myths about -- - copyright law, - free speech law, - libel law, - privacy law, - contract law, and - trademark law as they apply on the Net. Each CYBERSPACE LAW "lesson" should be about the size of an average TOURBUS post (about a page or two), and will e-mailed to you through an e-mail distribution list. The CYBERSPACE LAW workshop will last a couple of weeks, and you'll get two or three letters a week from the authors ... and, best of all, the entire workshop is FREE! THE INSTRUCTORS --------------- Professor Larry Lessig clerked for U.S. Supreme Court Justice Antonin Scalia, and now teaches constitutional law and the law of cyberspace at the University of Chicago Law School. He's written about law and cyberspace for the Yale Law Journal and the University of Chicago Legal Forum (forthcoming). Professor David Post practiced computer law for six years, then clerked for U.S. Supreme Court Justice Ruth Bader Ginsburg. He now teaches constitutional law, copyright law, and the law of cyberspace at the Georgetown University Law Center. He's written about law and cyberspace for the University of Chicago Legal Forum (forthcoming) and the Journal of Online Law, and writes a monthly column on law and technology issues for the American Lawyer. Professor Eugene Volokh worked as a computer programmer for 12 years, and is still partner in a software company that sells the software he wrote for the Hewlett-Packard Series 3000. He clerked for U.S. Supreme Court Justice Sandra Day O'Connor, and now teaches constitutional law and copyright law at the UCLA School of Law. He's written about law and cyberspace for the Yale Law Journal, Stanford Law Review, Michigan Law Review (forthcoming), and the University of Chicago Legal Forum (forthcoming). TO SUBSCRIBE ------------ The CYBERSPACE LAW workshop probably won't start for a month or so, but you should sign up as soon as you can. To subscribe to the workshop (for FREE!) send an e-mail letter to LISTPROC-REQUEST(a)COUNSEL.COM with the command SUBSCRIBE CYBERSPACE-LAW yourfirstname yourlastname in the body of your e-mail letter, replacing "yourfirstname" and "yourlastname" with your first and last names.

1 0

Re: Seeking Position
by Frank Willoughby 17 Dec '03

17 Dec '03

Those interested in an Information Security-related position might be interested in checking out: Cameron Carey Computer Security Placement Service (508) 393-7803 He specializes in placing InfoSec persons (only). His contacts are numerous and last time I checked, he knew of about a dozen or so openings. I have used him in the past. He's one of very few headhunters I have met who will actually work your resume & call you frequently with the status (where your resume is, the type of company, etc.). FWIW, it doesn't matter if you mention my name or not - I have no vested interest in recommending him other than I believe that people who do a good job ought to be recommended to others. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

Re: Cryptanalysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:52 AM 3/2/96, Alan Olsen wrote: >The author has failed to call me back. I do have some serious concerns >about the code. (There is not a single XOR used, except to clear >registers!) I am starting to suspect that it is based on a mathematical >progression based on the numbers 40, 28, 36. I need to spend a bit of time ^^^^^^^^^^ Ah, note that the magic key, 42, is not included. Coincidence, or stupidity? Alan, there is not enough time in the universe to waste it on those who will not learn even the basics. The "author," who I had understood to be a friend of yours (though apparently a more distant relationship is involved), is apparently developing something John Dee would have been proud of. Fortunately for the rest of us, cryptology has moved on in the last several hundred years. I again urge you not to waste your time on this. Or our time. (Trust me, in five or six years, if your friend sticks to his current course, he will announce to the world his "discovery" of the "virtual one time pad" and will be preparing a public stock offering in Silicon Snakeoiltronics.) A few other minor points: >>* The journal "Cryptologia" is largely devoted to amateur cryptanalysis. > >The web info for back issues listed a web page from a publisher that had no >listing for them on the server. I will be sending mail to get more info... Last I checked, Tony Patti was still the editor. Not all things are on the Web in serious ways, obviously. I had no problems finding copies in my local university library (UC Santa Cruz), but it was several years ago that I last checked (conventional cryptanalysis not being very germane and all). Reed College might have copies. >>There are very good reasons to say little about "conventional >>cryptanalysis": it just doesn't matter much with modern ciphers, such as >>public key systems. Modern ciphers don't fall to conventional attacks based >>on word frequency, pattern analysis, etc. > >Still an interesting topic... Perhaps as a hobby, for those who find the NYT crosswords exciting. But of little significance for modern cryptology, except as a cautionary tale. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0

Re: Problems with certificates.
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:35 AM 3/1/96 -0500, "A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> wrote: >Today, each person generates their own PGP key. While it is unlikely that >any two will match, it is likely that at some point some two will match >(see matching birthdays in a bar - number is less than you would think). PGP KeyIDs are 8 hexes long (formerly 6), and there have been some natural collisions and it's easy to manufacture them. On the other hand, the MD5 hash used for key fingerprints is 128 bits long, and cryptographically strong. So birthday-problem collisions occur when you have ~ 2**64 keys around, which is not a problem, and you can't generate collisions on purpose either. A 64-bit hash would be more interesting; you get collisions if you have around 2**32 keys, which could actually happen. >Next rage might well be "vanity" PGP keys. While at the moment it is not known >how to create a specific match key to a sequence, if you generate enough >keys, there will be some interesting sequences found. Possibly some PGP >signatures will even be in violation of the CDA (now that should start a rush 8*). :-) The main problem is the limitations of hex; keyids like 0xdeadbeef are available, but it's tough to really trigger Exonization that way. Using 32 bits as ASCII instead is a bit more flexible. >For some time I have been concerned about the scalability of PGP. It works >well in small groups but after trying once to create a 6,000 member keyring >(took over three days on a 386 & was several meg when done) Yeah - lots of people have been concerned about this. Keyservers simplify the problem a lot, since you no longer need to carry a large number of keys around yourself, but the keyring handling mechanism of PGP wasn't designed to scale. Wouldn't be too hard to redesign, once PGP 3.0 comes out and we've got tools to do it - you could use a database or decently structured ASCII file or files. And DNS or similar distributed keyserver can make it easier to find, for people who are on-line. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

2 1

RSAREF for Mac?
by Jay Haines 17 Dec '03

17 Dec '03

Subject: Time: 1:24 PM OFFICE MEMO RSAREF for Mac? Date: 5/14/96 It seems that I have seen this question asked before, but as I had no need for the answer at that time, I trashed it. So, without further ado: Can anyone point in the direction of RSAREF for the Macintosh? expectantly, (no, i'm not pregnant,) Jay

1 0

$:)$
by Kmiller＠aol.com 17 Dec '03

17 Dec '03

WARNING: THIS IS REAL !! Pass This Up Lightly And Youll Be Making One Of The Biggest Mistakes Of Your Life! ----FREE----FREE----FREE----FREE---- REGISTERED version of NetContact Retails for $300 and up This bulk E-mail software will EXPLODE your business ----FREE----FREE----FREE----FREE---- ALL I DO IS MAIL OUT 10 OF THE EXACT SAME SALES LETTER EVERYDAY !! That is all I do! I earn $140, $200, even $250 a day mailing out the exact same sales letter! There is absolutely no catch or crazy gimmick involved here, I promise you. This has nothing to do with any ridiculous envelope stuffing program, illegal chain-letter scam or worthless multi-level scheme! There is not an easier way to make $140 a day than this- if you would like to gain financial independence and success, listen up... I tried every moneymaking plan under the sun. After a couple years of constant attempts at striking it rich, I had done nothing but strike out. I tried multi-level marketing... I failed! I tried chain letters... They failed me! I tried envelope stuffing... What a joke! I figured I could afford the $30 or $40 for each of the programs I tried; until I realized not only does that build up, but I was making no money in the mean time. Bills piled up and the future started looking bleak. Luckily a friend informed me of this program, which turned my finances around. Not only is it profitable, but immensely profitable with only an hour or two a day worth of work! Here is what my 3 diskette program includes: 1) NetContact bulk mail software- REGISTERED 2) Master copies of my Special Sales Letters that make $140 per day 3)Complete business startup guides 4)Complete instructions and internet access to our secret website As you can see, for only $20, you are getting a complete business system with all the support you need! In the past I have licensed this system for $79.95. Available only for Windows95 and NT. cut here____________________________________________ I want to receive $140 every time I mail out 10 copies of the same sales letter that you will supply. Please rush me your Every-Day Cash Plan!! Enclosed is the $20 dollar cost. Send $20 cash or check to: HyperReal Box 136 2051 Richmond Road Suite 125 Lexington, KY 40502 Make checks payable to HyperReal Name_________________________________________________ Address_______________________________________________ City__________________________________________________ State/Province______________ Zip/Postal code_______________ Country if other than U.S._________________________________

1 0

Re: PGP to PC mail integration
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:18 AM 2/28/96 -0800, Mike Ingle <inglem(a)adnetsol.com> suggested setting up a VB program on localhost to proxy POP and SMTP requests for PGP, rather than hitting it from the user interface. >Once this is set up, the user burden is near zero, and it works with >any winsock-based mail program. What do you think of the idea? It'd probably be pretty convenient for incoming, though you need to build some mechanism for displaying the PGP output for signatures (since PGP gives you the contents of the signed material when you check the sig.). One interesting security problem is how to distinguish between the message your PGP bot drops in your mailbox containing the message and an indication that the signature is good from a message that someone carefully constructed that _looks_ identical but includes its _own_ indication that the (possibly bad) signature is good. For outgoing mail, you'd either have to sign everything, which may be good, or have a way to tell it the proxy whether or not to sign the mail, and you'd either need to hand it your passphrase each time or take the security risk of leaving an autosigner hanging around listening on a port, just _waiting_ for somebody to lie about where they're connecting from and get your bot to sign arbitrary things..... There are also minor issues if you use multiple keys, which most people probably should. Interfaces between VB and PGP262 are a bit crude - Private Idaho is a good example. The problem is that PGP262 is a DOS program, so you need to POP up a DOS window to run it in, and then make the window go away. PI does that just fine, but it's a bit ugly to watch; it's much cleaner with ViaCrypt's Windows-based PGP. PGP 3.0 will simplify this, since you'll be able to use PGP as a library instead of a hauling up DOS to run it in. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Chaff in the Channel (Stealth PGP work)
by Powers Glenn 17 Dec '03

17 Dec '03

- However, I suspect that the ideal would be like cryptography: - Assume the enemy knows everything about your system but the keys. - Thus, your gifs need to look like normal gifs in the lsb. Your audio - needs to have normal levels of hiss in it. Etc. the problem with many current stego programs (jsteg/stools) is that given a data stream, they will tell you if there is data steg'ed (by the same program, of course) it in. jsteg goes out of it's way to hide it's content-length header, but jsteg can still detect jsteg headers... glenn

3 2

PGP PRNG seeds?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I tinkered with the switch pgp +makerandom=size output.fil Is there a way to "seed" the PRNG with another file, say , part of an encrypted text file? Thanks JFA

1 0