- cypherpunks-legacy - lists.cpunks.org

Re: GUI: PGP vs novices
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <ab1c939b040210039926(a)[192.187.167.52]>, Dave Del Torto <ddt(a)lsd.com> wrote: >The Cypherpunks should really launch a new list oriented toward novices >with basic questions. It could be a Web page with a question form, or even >an email address for the Web-challenged (I may do it, but I welcome any >offers to help). As an incentive to Cypherpunks, their friends and >colleagues and members of the general public, I'm hereby offering to spend >some time answering questions for novice users at either: > > <crypto-questions(a)lsd.com> or > <pgp-questions(a)lsd.com>. I attempted to set something like this up about 7 months ago. I got so little interest that I never set up the mailing list. Better than a single person's address, I'd suggest a pgp-help mailing list for all interested folks, just as the flexfax list works for flexfax users and commercial products have their own lists. I just set up a list on pgp-help(a)hks.net, and I'll place pgp-questions(a)lsd.com on the list (assuming you won't object). Anybody else who's interested, send me mail at pgp-help-request(a)hks.net. I don't have the list of folks who volunteered last time, so this'll be fresh. - - -- Todd Masco | "'When _I_ use a word,' Humpty-Dumpty said, in a rather cactus(a)hks.net | scornful tone, 'it means just what I choose it to mean - cactus(a)bb.com | neither more nor less.'" - Lewis Carroll - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLwlY4hNhgovrPB7dAQEBvQQA1vxwGcYZ28qlytX3jrY95WN/L11X1FG2 MGwWjjk8BZ2cXk1uvLWtuhoNGwzqhup/aGLVGuPo2QjFPiqwjoA5pa+9+8093dpl tBMziDmJ5/Pg3jWirRiuuREa5Ki977I/uplp3Ysh0ioz07Ws44susZrcdDHbIChL TYKrC1DROi4= =GbTI - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLwmT2yoZzwIn1bdtAQFvxwGAgkaHPEh2A7NuPXJgtNBNqV4j9KrnLbex az8jQmFpTfBaAbLPfP5i7tdVPjJ21xom =yR+4 -----END PGP SIGNATURE-----

1 0

Listing of Files on the Auto-Responder as of 01-01-95
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Last Modified: 01-01-95 20:30 (CST) This is the index for Sam Kaplin's Auto-Responder. To get a file: Send a message to: skaplin(a)c2.org The the subject of the message MUST BE: SEND FILE [file_name] EXAMPLE: Subject: SEND FILE help <----Case Sensitive!!! All binary files are UUENCODED with PGP signatures. Please address all comments or problems to skaplin(a)skypoint.com. If you receive a blank message back, then the file you requested does not exist. Should you have a crypto related file that you would like added, contact me at: skaplin(a)skypoint.com. Please note that I am subject to the petty whims of the U.S. government, so I will not add any files which may be subject to ITAR. - -------------------------------------------------------------------------- File Name Description - -------------------------------------------------------------------------- apgp212_1.uue Autopgp 2.12 offline mail packet processor. Automates PGP functions. Part 1 of 4 apgp212_2.uue Autopgp 2.12 offline mail packet processor. Automates PGP functions. Part 2 of 4 apgp212_3.uue Autopgp 2.12 offline mail packet processor. Automates PGP functions. Part 3 of 4 apgp212_4.uue Autopgp 2.12 offline mail packet processor. Automates PGP functions. Part 4 of 4 apgp22b2_1.uue Autopgp 2.2b2 offline mail packet processor. Automates PGP functions. Part 1 of 4 BETA apgp22b2_2.uue Autopgp 2.2b2 offline mail packet processor. Automates PGP functions. Part 2 of 4 BETA apgp22b2_3.uue Autopgp 2.2b2 offline mail packet processor. Automates PGP functions. Part 3 of 4 BETA apgp22b2_4.uue Autopgp 2.2b2 offline mail packet processor. Automates PGP functions. Part 4 of 4 BETA cp-faq1.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 1 of 11 cp-faq2.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 2 of 11 cp-faq3.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 3 of 11 cp-faq4.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 4 of 11 cp-faq5.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 5 of 11 cp-faq6.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 6 of 11 cp-faq7.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 7 of 11 cp-faq8.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 8 of 11 cp-faq9.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 9 of 11 cp-faq10.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 10 of 11 cp-faq11.uue Tim May's Cypherpunk Faq - Everything you wanted to know about C'Punk issues, but were afraid to ask. Part 11 of 11 crypto1.uue The Faq from talk.politics.crypto. A general overview of cryptography. Part 1 of 2 crypto2.uue The Faq from talk.politics.crypto. A general overview of cryptography. Part 2 of 2 help This file. key Sam Kaplin's PGP Public keys. news_gateways A listing of Mail -News gateways pgpfaq1.uue Frequently asked questions about PGP. Part 1 of 2 pgpfaq2.uue Frequently asked questions about PGP. Part 2 of 2 rsa1.uue A Faq put out by RSA outlining cryptography as it applies to RSA. Part 1 of 2 rsa2.uue A Faq put out by RSA outlining cryptography as it applies to RSA. Part 2 of 2 remailer_list A current listing of remailer sites. wherefaq.long Where to obtain PGP. (Long Version) wherefaq.short Where to obtain PGP. (Short Version) yn075_1.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 1 of 14 yn075_2.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 2 of 14 yn075_3.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 3 of 14 yn075_4.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 4 of 14 yn075_5.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 5 of 14 yn075_6.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 6 of 14 yn075_7.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 7 of 14 yn075_8.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 8 of 14 yn075_9.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 9 of 14 yn075_10.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 10 of 14 yn075_11.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 11 of 14 yn075_12.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 12 of 14 yn075_13.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 13 of 14 yn075_14.uue YARN .075 offline mail reader. Minimally supports PGP internally. Part 14 of 14 ============================================================================== Interpretation is the revenge of the intellect upon art. - Susan Sontag ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwepPslnXxBRSgfNAQFjuAf/YfaeENpC16siv7SB9rkg6x1SiM5aup6n GXQQXaXtPA1pxgLDhv6gOgt/Zy/1M6tTJ/4uU2ft1KDU8wHlVt2JiU3d9/9JweZM zbpDCqh0ucyfRht2V27WMfYYfTXUQ7yHiWIg9gf2ODqQcwMEu8kAwTYZxXFmXDQ+ 9Xxchw7VR4ZGTo3cnPoh0526yKGBbi9hBr0vCr/IkTGH4cgf3BfXIF8Eolu4hQY3 r6XwcBYskN5afd/fVKA1qRhLkI3X9nP4oBNlVxdSs2cwgabQ2hZsExwtCwvHMi3K zGWAwZkd1VNMX4rC+uUkuEOR0GB9OikcRYoU9vvKDSHO1n6amnQamQ== =eeBK -----END PGP SIGNATURE-----

1 0

Re: Exporting cryptographic materials, theory vs. practice
by Lile Elam 17 Dec '03

17 Dec '03

But what if that plane crashed... It's better to spread people out over several flights... -lile

1 0

Anonymous payment scheme
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This idea just popped into my head, just as I was about to fall asleep. Being the idiot that I am, I had to get up to write it down. This idea has probably been presented before...but I haven't seen it here yet. Let's suppose myself and 10,000 of my closest friends form the First National Cypherpunk Bank and Trust. We go through all of the hassles in order to be the issuer of a Master Card or Visa. Now instead of having a credit line, it is set up as a debit card. The card's limit is how ever much you have prepaid the bank in advance. Once you have hit your prepaid amount the card no longer gets approved. Now because everything is prepaid, there is no risk to me, so I'll put any name you want on the card. The questions I have are: Is this legal in the U.S.? If so, is anyone doing it? If it's not legal in the U.S., is it legal anyplace else. If this is a gray area, why wouldn't this scheme work? If this scheme was set up, it appears to me that the infrastructure for anonymous payments/netcash is already in place. Of course the issuer would get a healthy fee for issuing the card...but then again, there truly is no such thing as a free lunch. As my 10,000 friends and I have no plans to set this up, feel free to pick it apart at will. (which I'm sure it will be) Sam ============================================================================== There is an order of things in this universe. -- Apollo, "Who Mourns for Adonais?" stardate 3468.1 ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwe/6clnXxBRSgfNAQGZBAf9FAHHsI63OJ1uQo4SGAggs6Mk7BAe8Ysm oxibQfvNMN0dSPdyLjHutEm5/rtyTrRjU731QRQSDLUi0LSC9I0N5/cQsGeI+VV8 kAIiuHDq1eF4oZmZTuKIcKz42THliSAhSTkmpL8dZvcU3sJVPwIfGK5dNbQyUQHw J33h74Vg1jRIkeoodnAtTXPeUKi5HkcAp95zt8C/tGpke4+fx8QhqHSAvJgJoGdL a8clRTdilqwDfrdQlpgKHt33T5aLiYuQA8m9NpMiDKw/wEF+XvMrHYrksIUyQ2ZD gllxFl0WJcarRZTnIgtgAdA+hzQCbkfG10kcZUVTzquGcrgiKnp9ug== =l5Mr -----END PGP SIGNATURE-----

9 10

Re: Exporting cryptographic materials, theory vs. practice
by Marc Horowitz 17 Dec '03

17 Dec '03

>> My conclusion from all this is that it just isn't possible for an >> individual traveler to follow the rules. I can think of a at least half a dozen cypherpunks who will be going to IETF in Stockholm in July. I suspect there are more. Perhaps we should all arrange to take the same flight, while carrying some bit of approved-for-export material. Should drive the Customs guys completely nuts. Marc

6 5

EVEN MORE creis for regulation
by Nesta Stubbs 17 Dec '03

17 Dec '03

Yet ANOTHER call for net regulation. There are so many now I am hard pressedto keep track of them. It appears that the media may adopt "regulation of the Internet" as it's next babe. Ya know how the adopted the Internet itself first, now watch as the entire mainstream media is flooded with calls for net regulation. Bigots' Growing Use Of Computer Networks Assailed The Simon Wiesenthal Center on 12-13-94 sent a letter to Prodigy protesting bigots online messages of hate. Rabbi Abraham Cooper of the center decries the growing use by hate groups. The Wiesenthal Center wants government policing of the internet. They fear one-sided exposure of youths to white supremacist messages. Civil libertarians and white supremacists say that free speech should prevail. Marc Rotenburg of the Electronic Privacy Info Center says that it's a difficult issue and that censorship and control are ver y inappropriate. White supremacist groups like the National Alliance and the American Rennaisance can spread propaganda nationwide. These types of hate groups are kept out of mainstream media and are thus short of funds. Valerie Filds of West LA said she saw an anti latino diatribe on Prodigy that plugged American Rennaisance of Louisville KY. She says she saw a message that seemed to be from a white supremacist group. She says she saw one referring to the "Diary of Anne Frank" as a "Jewish Hoax". The Wiesenthal cente r wants such messages deleted. Anti-semitic comments on Prodigy in 1991 resulted in a policy prohibiting "blatant expressions of hatred". Kevin Strom, who produces a radio show for National Alliance, said he was recently blocked from forums on Compuserve. He said that "the system operator decided we didn't deserve free speech." His article "The Wisdom of Henry Ford" about the book "The International Jew" was downloaded 120 times. Georgia Griffith of Compuserve said "we are not oblidged to publish it for him." There are 5 m subscribers to commercial online services, 2 m to Prodigy, 20 m accessing the internet. Rabbi Cooper wants the FCC to place a cop on the internet. White supremacist propaganda is available on the internet. The Institute for Historical Review's article "Frequently Asked Questions about National Socialis m" is available. Far-right activists say anonymity removes inhibitions too. The National Alliance uses Netcom Online Communications Services in California. Texts and promotions of its radio show are available there. National Alliance chairman William Pierce said "The major media in this country are very biased against our political point of view. They present us with ridicule or in a very distorted way. The information superhighway is much more free of censorship."

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 2 Jan 95 6:00:02 PST remailer email address history latency uptime ----------------------------------------------------------------------- nately remailer(a)nately.ucsd.edu +++++++++++* 32:53 99.99% mix mixmaster(a)nately.ucsd.edu +++++++++-+ 41:39 99.99% rahul homer(a)rahul.net --***#***#** 9:40 99.98% penet anon(a)anon.penet.fi ********+*** 26:09 99.99% vox remail(a)vox.xs4all.nl .-..------- 12:53:05 99.99% soda remailer(a)csua.berkeley.edu .-.._-.-.. 8:50:49 99.67% usura usura(a)replay.com *****+- -- * 22:53 99.33% flame tomaz(a)flame.sinet.org ** *-*-*-** 32:52 99.09% jpunix remailer(a)jpunix.com ** *-#-*-** 32:26 99.06% c2 remail(a)c2.org --__.-+*--** 2:50:57 98.95% rebma remailer(a)rebma.mn.org ---*----* 7:52:32 99.27% ideath remailer(a)ideath.goldenbear.com ++* ++** - 2:09:26 98.05% bsu-cs nowhere(a)bsu-cs.bsu.edu +* --#+##** 1:40:45 96.01% q q(a)c2.org --_ . --+ 6:03:15 92.56% alumni hal(a)alumni.caltech.edu *****#*++ *- 27:00 89.60% portal hfinney(a)shell.portal.com #*#**#*** *- 21:31 89.60% extropia remail(a)extropia.wimsey.com +.-+* +++ 12:38:44 77.66% xs4all remailer(a)xs4all.nl *** *-- 20:22 75.57% desert remail(a)desert.xs4all.nl ----____.-- 40:43:30 71.96% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

(Fwd) Re Anonymous posting
by John Young 17 Dec '03

17 Dec '03

For those interested in the anonymity issue there is a lively debate on list Cyberia-L (a legal list) which was stimulated, in part, by Peter Lewis's articles on anonymity and the LaMacchia case dismissal. For participation send message to: listserv(a)listserv.cc.wm.edu subscribe cyberia-l Your name Provocatively, I forward the following: Forwarding mail by: jsilverm(a)reach.com (Jared Silverman -- NJ Bureau of Sec. - Newark) on Mon, 2 Jan 11:58 AM ------------------- On January 1, 1995, Buford Terrell wrote: >Anonymity is very much a core 1st Amendment value and at the >center of both political speech and the right to assemble. [Snip] >Often times, the only way weak or unpopular minorites can speak >is anonymously. There have been many times when to couple one's >name to one's writings would be to invite martyrdom. I had >rather risk a few perverts than to stifle this most important >channel for dissent. It is one thing to claim First Amendment protection to shield political speech, IMHO it is another to shield fraud and criminal behavior. Besides the First Amendment runs against the government, not in favor of individuals in actions brought by private parties. In the sexism thread, would anyone claim that an individual has the right to harass or stalk a person under the guise of the First Amendment? Would the First Amendment be a defense in a defamation suit? Of course not (Times v. Sullivan aside). Doesn't an individual have the right to know the identity of someone who is trying to communicate with him/her on a private basis? To a certain extent, the question was crystallized in the caller ID debate -- Who has the superior right, the calling party to anonymity or the called party to knowing who is calling? One of the areas of my professional concern is the use of cyberspace for securities fraud and manipulation. Cyberspace is an ideal medium for these activities because of the availability of anonymity and pseudonymity. Even on commercial BBSs, where "member lists" are available, posting to these lists is voluntary and those who draw my attention are rarely on these lists. Does all of cyberspace become off limits to conventional private rights and law enforcement under the rubric of "freedom of speech and assembly?" |--------------------------------------------------------------| |A. Jared Silverman, Chief-New Jersey Bureau of Securities | |jsilverm(a)reach.com | 201-504-3600 (phone) | 201-504-3601 (fax)| |**************************************************************| | My purpose holds to sail beyond the sunset - Tennyson | |**************************************************************| |The foregoing is the personal opinion of the sender and is not| |the official position of either the Bureau of Securities or | |the New Jersey Attorney General and the Department of Law and | |Public Safety. Affiliation given for identification only. | |--------------------------------------------------------------|

1 0

Re: Exporting cryptographic materials, theory vs. practice
by nobody＠rahul.net 17 Dec '03

17 Dec '03

Matt has a good story, and the lesson that he draws, that presently the average person can't follow the rules, seems valid. But I don't see the point of the proposals to replicate his experiment. Doesn't Matt's experience really show simply that not enough people try to follow the rules, so the agencies aren't set up yet to make it easy? Is it our goal to change this, to get Customs to streamline their operation so that everyone really does register their crypto equipment on travels overseas? It seems to me we are better off with the present informal system where you can actually use crypto overseas without worrying much. I could see a system where you routinely fill out and have your card stamped when you check your luggage to show that you are carrying crypto. Then you turn it in when you come back. This might not be too different from what you do now when you declare items you are taking out and bringing back to show they are free of customs duties. How does this advance the CP cause?

2 1

RFC: Key Capture Utility Survey
by KEY-CAPTURE＠lsd.com 17 Dec '03

17 Dec '03

REQUEST FOR COMMENTS ON KEY CAPTURE UTILITIES --------------------------------------------- Key capture utilities present a serious threat to the security of passwords on individual and networked computing systems, especially when novice users are unaware of their presence. Well-educated users and administrators help make all systems on and off the Internet more reliably safe for everyone's data. If you are a: -- privacy, system security or cryptography advocate/activist -- network admin concerned with the password-hygiene of your users or -- computing professional with an appreciation of good security, then please complete and return this quick survey. By contributing to the knowledgebase on the subject of password protection, you can help educate yourself and many novice/intermediate users about a common weakness -- utilities that may capture their keystrokes unseen as they enter their *password* -- in ALL secured systems (a user's encryption app, your network or its dial-in access, your company's email system or database fileserver, etc.). The intent here is to create a *central list of all key-capture utilities* which will help people to at least be aware of their existence or operation on a given system and describe in simple terms how to disable the utility. The results of the survey will be tabulated and put in the public domain on the Internet. If your reply is included, your name will be acknowledged in the resulting document, which will be: part of the new "Beginner's PGP FAQ" for new users of the PGP (Pretty Good Privacy) application; a msg posted on various Internet lists and online services and; a text file available by anonymous FTP as: ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/key_cap_util.txt Please forward this survey to anyone you think can/will help - and thanks in advance for your contribution! _______________________________ THE KEY CAPTURE UTILITY SURVEY: The survey is very easy to participate in. Just send as much information as you can, even if you're only partially able to complete the form. Every piece of information that can lead us to the utility - even just a fragment of a name and an email address of someone who might know more about it - will help us compile a fairly exhaustive list. To assist us in easily tabulating the incoming mail on this topic, please send your reply to: - - <KEY-CAPTURE(a)lsd.com> - - Format your answer as follows: ******* PLEASE RETURN ONLY THIS INFORMATION ******* TO: KEY-CAPTURE(a)lsd.com SUBJ: PLATFORM/Utility Name MSG BODY: [1] OPERATING-SYS <--- i.e. WIN/DOS/MAC/OS2/UNIX, etc. [2] "Utility-Name" (utility-package-name, if not a stand-alone product) [3] Developer-Name (company-individual) [4] <developer-email-address> [5] Type <--- i.e.: system extension, autoexec, TSR [6] Path-to-file-location-when-loaded. [7] How to disable the utility's key capturing operations (step-by-step if possible). Please be brief, but aim for a novice level user. If disabling the key capturing is too complex to describe easily, then just explain what the user should ask a sys admin to do for them (while they watch, if applicable). *************************************************** (Here's an Example:) SUBJ: MAC/Now Save MSG BODY: [1] MAC [2] "Now Save" (Now Utilities v5.x), "NowSave" (Now Utilities v4.x) [3] Now Software, Inc. [4] <support(a)nowmail.nowsoft.com> [5] System extension/Control Panel device (CDEV) [6] [startup HD]:System Folder:Control Panels:Now Save (or :NowSave) [7] How to Disable: Open the "NowSave" (v4.x) or "Now Save" (v5.x) Control Panel. v4.x: Click the "Preferences" button. Click the "Key Capture..." button. Click the "OFF" radio button (upper right corner of dialog). Click the "OK" button. v5.0: Click the "Key Capture..." button in the button-bar. Click the "OFF" radio button (in upper right corner of dialog). Click the "OK" button.

1 0