- cypherpunks-legacy - lists.cpunks.org

Re: Hazards of encouraging forged dig sigs
by Mark Grant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 30 Nov 1994, L. McCarthy wrote: >Encouraging cryptographically >valid signatures was the first suggestion I'd seen in this entire debate >which seemed to promise tangible benefits; encouraging cryptographically >invalid signatures is the first notion which appears to offer tangible >detriment. As one of the few people who verify all PGP signatures for which I have keys, I have to say that encouraging people to put garbage in PGP signature blocks would be extremely annoying. Either I'll have to go back to using a non-PGP-aware mail reader, or fix it to do something sensible with such messages. While I'm going to have to do the latter at some point anyway, there are much more useful things that I could be doing... Mark -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLt3Kw6FlWzerDvH1AQEyTgP/bPz1NLXeicLD81Ijj8S6/m+D3Tmb363Q +Xj5MDsW+xBNC+p8ViKzZ+zvjZg5Cr6MsQ24TWT3n7DId7l2pAWyAH5JWf7OuW9u xvrfMfFas04RuOE8mjO7Gcp9E3eFNKz9MNQGlG7YwkPLX/twbF7+gX1RWkPGV2JE +b+KOjVkQbs= =lLbP -----END PGP SIGNATURE-----

1 0

Re: premail 0.30
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've also installed premail as /usr/lib/sendmail, and it works fine. I haven't had any problems with it reading my ~/.premailrc file. I was a little queasy about installing it as sendmail, but I'm very glad I did. It hasn't caused any problems at all, adds a lot of functionality, and doesn't seem to extract too high of a penalty in terms of overhead. I'm not sure how sendmail forks for incoming mail, but my impression is that the additional instance of sendmail is created without calling premail. If that's true, then premail installed as sendmail doesn't add any overhead at all for incoming mail. This was a big concern for me, because I don't have very much memory or processor power, but so far everything's been working great. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtvvxREpP7+baaPtAQFq5wQAzT295CbJIQXJU8chI4Cwm9rHGa4mbqNV +geDhS02z/ttYjMIoXRh1066YmnSEB3/3uqQPL4K1w8SP3z7uYfQwDwKwbmRdoPa p03ksQ8PEK/9dbRc05azjz4PFpMTqk4HDhyQnM3xRo34DPNbnfl4HUSMbccvdCEw vS4Vip00zX0= =+du+ -----END PGP SIGNATURE-----

1 0

Re: Mandatory message signing
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:59 PM 11/29/94, L. McCarthy wrote: >Hold the phone ! As I understand the law, only one party to a telephone >call has to be aware of the recording for it to be perfectly legal. Someone >not party to the call can't do it, but any one of the people talking can do >it. I believe it varies from state to state, but this is indeed the norm. >handle authentication like this. Ideally, some people would get together >with Brent Chapman and incorporate authentication of signed messages in a >future release of Majordomo. I'd love to volunteer for a project like this >but I don't believe I can spare the time. Why stop at authenticating signed messages? I'd like to see some mailing list software that would send mail out to you encrypted if you want (sure, the list is probably public, but you might not want people knowing you subscribe. If list traffic was encrypted, and you routed it through Ghio's remailer-alias doohickey, the fact that you subscribe could be kept completely hidden), and would require authentication on a message to change your address, or to change your public key (which would also be possible). And would have config parameters such that the list operator could make it only accept signed submissions, or even only accept submissions encrypted to the list. [not that I'm advocating this on the cypherpunks list, but it might be good on other lists, especially private ones]. And Ideally, I'd even like the list to be able to mail to you through the remailer-net, by prepending your encrypted address block, and sending to a remailer. Although the existence of Ghio's forementioned doohickey (what is that service being called?) makes that somewhat superflous. I was planning on writing such a beast myself, and might still get around to it eventually. The problem is that I'm unlikely to write something from scratch as robust as the current list server software (I'm not interested in writing good list software, just in implementing the crypto), and I'm not really skilled enough to understand the majordomo code enough to modify it. But I might try, one of these days.

1 0

premail 0.30
by Michael K. Sanders 17 Dec '03

17 Dec '03

I've got premail v0.30 installed here as /usr/lib/sendmail. I added the $config{"sendmail"}="real_sendmail" option, but this means that ~/.premailrc is not used. But that users can't specify their own options... Specifically, it looks as if doing it this way I can't automatically PGP sign my mail without adding it to the global script, but that would mean _all_ mail out of this site would be signed with my id. Any suggestions how to go about this? It makes it so convenient to have it replace sendmail, but I'd like to sign my mail as well. -- Michael K. Sanders -- msanders(a)ataxia.res.wpi.edu ataxia: NetBSD/Amiga 1.0 - Creating Chaos out of Anarchy for a Better Tomorrow Ataxia Home Page

2 2

Re: "You aren't following the _rules_!"
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 3:58 AM 11/29/94, Lucky Green wrote: >I do not mean to belittle the work that has been done, but unless the >encryption is built into the mailer and using a remailer means clicking the >"use X remailer(s)" button, and the mailer better know which ones are >working and do the PGP envelopes, it won't happen. Have you used premail? It pretty much does all of that. People still aren't using premail, either because they can't figure out how to install it (doubtful, it's not hard to install), or because they don't have a need for it that's great enough to justify the (minimal) time neccesary to ftp it and install it, or wait the (sometimes more painful) time neccesary for the computer to encrypt and/or sign your outgoing messages. Which was admitteedlyu your main point; until there is a _need_ for crypto, it's not going to be used. Because premail makes it incredibly easy to use PGP on a unix box. And, for that matter, the Eudora/PGP applescritps make it incredibly easy to use PGP on a mac. And there are some people working on an applescript that will automate using remailers on a mac too. But ease of use appearantly isn't enough; no matter how easy it gets to use, it's still going to have some cost to the user over not using it. Even if the cost is only having to wait the 1.5 seconds it takes your machine to decrypt/encrypt a message. Unless there's a use for it, people won't be willing to spend that 1.5 seconds per message.

3 2

Fighting Censorship at Canadian Universities
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Used to be that Universities were bastions of free thought and discussion. Guess not nowadays, if this E-Mail to me earlier today is any indication: - -------------------------------------------------------------------------- - From kyleh(a)cs.mun.ca Wed Nov 30 01:01:19 1994 Date: Wed, 30 Nov 1994 00:47:41 -0330 From: Kyle Douglas Hearfield <kyleh(a)cs.mun.ca> Subject: interested in PGP To: werewolf(a)io.org Mark, I am a Student at Memorial University of Newfoundland, and I have recently been censored and had my postings to newsgroups aborted. I received a message from our system administrator that the messages(of a political nature) were not appropriate. I was wondering if I could use PGP to get past them? I have read some about PGP, but I am still kind of in the dark as to how it works and what it can do. Any info you could provide me would be much appreciated. Thanks in advance, - -------------------------------------------------------------------------- Maybe he was posting some stuff that contravened university policy...shrug. But with the recent events at McGill University in Montreal, I'm prepared to give him the benefit of the doubt. The first step was to provide him with the instructions to the the xs4all remailer. If he figures that is what he needs (more importantly....if he isn't scared off!) then I'll give him the list of the other remailers and mail him a copy of PGP. Who knows? Maybe all he needs is anon.penet.fi :> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtwbn6+YbMzawbu5AQHFUwP8CbzooBrhWKVHRaRIBn55ha3mYWIO62lZ 6D09DJvc9YAnwxbSVcE1X8MjNuR9XbRRrJfQMI8lnSWt8pr13FsI8cjHQqjzS9yk HXMYSKy7mdnerHaZSTK0RZdFrRHST6a5qVdNw4ffZsjO4WM/02nN/u9n5ywgsu4C dbCQlp9EMPQ= =mnSN -----END PGP SIGNATURE-----

1 0

AUTOPGP
by Mark Terka 17 Dec '03

17 Dec '03

Anyone know where I can get a copy of AUTOPGP? I'd like to try it out and see whether it has any advantages over YARN's integrated PGP functions. -------------------------------------------------------------------------- Mark Terka | werewolf(a)io.org | public key (werewolf) by Toronto,Canada | dg507(a)cleveland.freenet.edu | public key server or request ---------------------------------------------------------------------------

2 1

Re: Sign-or-delay
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric Hughes writes > I am still considering the "sign-or-delay" proposal for the toad.com > server, that is, sign your articles to the list or they'll be delayed > and eventually rejected. Well, it's easy to require people to include PGP signatures. However, for some people, it's difficult to do signatures in a secure and also convenient fashion across a mix of mailers; Tim's netcom+Mac example, or anyone using an insecure system. My laptop where I get my work-related mail really can't handle the volume of mail I get from cypherpunks; I'm using it as a terminal to talk to a netblazer to telnet to a Sun where I still have an account several gateways away, on which I haven't been root for over a year... Sure, I forward some of the interesting mail to the not-very-diskful laptop, and could wait for it to arrive and PGP-sign my replies, which will delay my articles anyway. On the other hand, if I sign them here, half of AT&T could probably grab the passphrase with a sniffer, so it's not something I'd trust my real keys to. Similarly, I wouldn't put real keys on netcom or other mass service provider. On the other hand, how carefully were you planning to make your system check signatures - does toad.com have the spare cycles to validate them all, or are you really going for syntax only? Thanks; Bill -----BEGIN PGP SIGNATURE----- Version: 3.2beta AjtHiSiSnOtAsIgNaaTuretHiSiSnOtAsIgNaaTuretHiSiSnOtAsIgNaaTurexZ ITsBoGustHiSiSnOtAsIgNaaTuretHiSiSnOtAsIgNaaTuretHiSiSnOtAsIgfoo ReAlLyTrUsTmetHiSiSnOtAsIgNaaTureLouisFreehWasHeretHiSiSnOtAsIgN tAsIgNaaT -----END PGP SIGNATURE-----

3 2

Economist's Dash for E-cash
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I've been away for a couple of days so I don't know if this has come up already, but... The Economist has proven yet again my firm belief that it's the most wired magazine around. In a special report on e-cash in the latest issue, it presents a lucid description of the pros and cons of different digicash, including Chaum. It then goes on to discuss in detail how e-cash could work, how it would be backed by real money and therefore not earn interest, how governments might get worried by the development of implicit currency markets beyond their control, how eventually e-cash might become an independent currency with no 'real' value, hinting at my outline of 'cooking-pot' markets in Electric Dreams #37. ObHeeHee: an article on the anti-DWEM backlash against Shakespeare quotes Gary Taylor, editor of the Oxford Shakespeare, as saying that "Shakespeare helped murder" Nicole Simpson. Why? The play Othello "makes a wife-murderer not only tragic but also, pervesely, heroic." ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: PGP hook for Eudora?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:17 AM 11/30/94, dmandl(a)bear.com wrote: >I keep hearing about PGP hooks for (Mac) Eudora, but a casual search >of at least five advertised ftp sites has turned up nothing. Can >someone post an address where this stuff can definitely be found? There is a bunch of applescript PGP stuff, in various states of done-ness, at ftp://ftp.netcom.com/pub/xenon. I'm not quite sure what the status of this stuff is, or if it's actually final release software, or just betas and such, because xenon seems to have disappeared for an indefinite period of time and isn't answering email. You want the MacPGPKit Installer, and the Eudora/PGP scripts (I'm not sure about the exact name for the Eudora scripts). In my own experience, the Eudora scripts work really well and are quite stable, but the more general purpose MacPGPKit has some problems and isn't so stable.

1 0