- cypherpunks-legacy - lists.cpunks.org

Re: Britain to control crypto - official (fwd from Usenet)
by jim bell 17 Dec '03

17 Dec '03

At 07:38 PM 6/17/96 -0400, Simon Spero wrote: >4) Will LEAs be permitted to impersonate a non-consenting third party >for the purposes of allowing a conversation to be intercepted? >(blatant violation of the 4th ammendme... oh shit- never mind). You may recall discussions on CP many months ago concerning the extent to which an Internet provider would be obligated to obey a cop with a warrant who asks for (for example) a "data wiretap" of a customer. I happen to believe that one of the things that's going to have to be settled, and settled soon, is a ban on governments coercing people (ISP's, etc) to violate their contracts with others. If my ISP enters into a contract with me to (among other things) tell me if my data is tapped, OR he agrees to send me a certification of non-tap status daily as long as it's valid and cease sending them when tapping starts, etc, presumably if he fulfils his part of the agreement I will soon learn of a tap. One of the things that was particularly important to the Founding Fathers was what they referred to as "Impairment of Contracts," which meant as I recall the act of government passing laws and rules which affect my ability to contract with you. Not surprisingly, they didn't like that, such restrictions. If their desires were respected, presumably there would be no way for the government to come between two contractors to get one to betray the other. Jim Bell jimbell(a)pacifier.com

1 0

Netscape Mail Security and PGP Plugins
by Greg Kucharo 17 Dec '03

17 Dec '03

There hasn't been a lot of discussion on this list about the future of secure e-mail via Netscape. The most i've seen has come from Raph Levien on the standards battle between S/Mime and other various implementations including one using PGP. Raph has said at various Cypherpunks meetings now that( and not wanting to totally put words in his mouth) the PGP based implementations have lost ground to S/MIME. The reason I believe that this whole area has received so little quarter on the list is that either few people use Netscape for e-mail and that few people actually send encrypted e-mail. I'm going to try and put together a compendium of web links on this so it's a little easier to track the developments and various schemes. At the second to last Cypherpunks Bay Area meeting we had a discussion of crypto GUI's. It's my opinion that Netscape would be an excellent place to start because it does encryption relatively seemlessly. Incorporating S/MIME into the mail would be a great step forward in bringing easy crypto to the general community. Any PGP plugin I would hope eleviate the many UI problems PGP has. A couple of questions I have right off the bat are; 1. In Hal's Java mail encryptor, what are the legal aspects of sending code across that contains crypto? 2. Can any plugin access the Netscape Mail program. 3. When is S/MIME going to be in Netscape, I tried to find info on the web site but thier statements about S/MIME seem vague. I hope I'm not running over old ground, but this has to be alot more intresting than discussing that PBS show! Greg Kucharo sophi(a)best.com

3 2

Re: Pickle Angels?!? (Humour)(Noise)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 Jun 96 at 19:35, William Knowles wrote: > On today's Sally Jesse Raphel was Curtis Swiva? > founder of the Guardian Angels talking about his new record > of eating pickles. He plans to break the record for eating > 22 hot dogs in 12 minutes.... I can see it now... "In a rather ironic twist of fate, Curtis Sliwa was the first person charged with violating the Communications Decency Act (upheld by the Supreme Court) after a web-surfer in Tennessee complained about digitized pictures of himself breaking the world's record for eating hot dogs which were posted on his web page..." Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Federal key registration agency
by Anonymous User 17 Dec '03

17 Dec '03

>Compuserve Online Today Daily Edition, 15 June 1996: > >Speaking to the Commonwealth Club of California in San Francisco, Reno said >her plan would require people to register with the new agency the secret >codes -- or "keys" -- they use to encrypt messages online. > >Reporting on this speech, Sandra Ann Harris of United Press International >adds, "Federal authorities could then obtain the information they need to >decipher the encryptions using a court order and secretly monitor electronic >communication on the Internet the same way wiretaps are used to monitor >telephone conversations of suspected criminals." Consider the logic of this statement. If some *criminal* has registered his/her secret key with the government, then why the hell would s/he then encrypt an incrimating message knowing the government could crack it?! Great plan, Janet..... Medea

1 0

The IESG: Protocol Action: MIME Security with Pretty Good Privacy (PGP) to Proposed Standard
by Perry E. Metzger 17 Dec '03

17 Dec '03

------- Forwarded Message To: IETF-Announce:; Cc: RFC Editor <rfc-editor(a)isi.edu> Cc: Internet Architecture Board <iab(a)isi.edu> From: The IESG <iesg-secretary(a)CNRI.Reston.VA.US> Subject: Protocol Action: MIME Security with Pretty Good Privacy (PGP) to Proposed Standard Date: Wed, 19 Jun 96 11:06:28 -0400 Message-ID: <9606191106.aa22287(a)IETF.CNRI.Reston.VA.US> The IESG has approved the Internet-Draft "MIME Security with Pretty Good Privacy (PGP)" <draft-elkins-pem-pgp-04.txt> as a Proposed Standard. This has been reviewed in the IETF but is not the product of an IETF Working Group. The IESG contact persons are Harald Alvestrand, Keith Moore, and Jeff Schiller. Technical Summary This document describes how Pretty Good Privacy (PGP) can be used to provide privacy and authentication using the Multipurpose Internet Mail Extensions (MIME) security content types described in RFC1847. Working Group Summary This document was not the product of an IETF working group but was reviewed via a 4 week IETF wide last call. The last call failed to raise any significant issues. Protocol Quality This document was reviewed for the IESG by Jeffrey I. Schiller. The protocol provides for an elegant way of encapsulating PGP objects within a MIME framework by making use of Security Multiparts for MIME (RFC1847). This permits a MIME aware user agent to read and process PGP signed and/or encrypted messages, yet it provides sufficient backwards compatibility for users with non-MIME aware mail user agents to make use of PGP directly to manually process messages prepared with this protocol. ------- End of Forwarded Message

1 0

Re: Digital Cash application
by declan＠well.com 17 Dec '03

17 Dec '03

Jim: This is a nice idea, but it's not going to happen. Yes, Harry Browne has raised enough money to qualify for matching funds from the FEC. But he's unable to give out the cash or use it to pay down the gvt debt since doing so could violate FEC regulations. The FEC is also unwilling only to certify Browne for matching funds without giving it to him -- he's got to take the money and spend it on campaign foo and nothing else, says the government. Finally, once they give you cash you have to meet a higher degree of scrutiny, which costs money in lawyers and accountants. Talk about bureaucracy. At least this is what the party tells me. I'll be covering their convention, which is in DC a few weeks from now. -Declan >In 1996, the Libertarian Party will apparently qualify for Federal matching >funds for its Presidential political campaign. That does not mean that it >will _accept_ them, being stolen goods. However, a few years ago I heard of >an idea that they should accept the money, and return it to the people, a >small amount at a time, to whomever asks for it. Besides returning the >stolen money to its rightful owners, that would produce substantial positive >publicity for the Libertarian party, embarrassment for the Democrats and >Republicans, while at the same time reducing the amount of money available >for the D's and the R's. > > >But there's been a practical question of how to actively do this, >economically. Issuing checks and mailing them costs money, and they're >traceable, etc. The advent of digital cash suggests an answer: Make the >payments in the form of digital cash, payable on the Web. This will >encourage the use of digital cash, and provide a sudden infusion that will >promote other uses. There's another advantage, however. Since "Netizens" >are somewhat biased towards libertarianism, this will have the effect of >keeping more of this money "in the family" as it were, while at the same >time being open, technically, to everyone who can get on the 'net. > > >Jim Bell >jimbell(a)pacifier.com

1 0

FBI utters root passsword to the Constitution
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

FBI InfoSec Guru Randy Perlman (Prilamen? Filament?) was interviewed on CNN BizNews this morning by Deborah Marchini: "Hackers" are menacing the net and society. Marchini prompted him but he concurred: Hackers are a *THREAT TO NATIONAL SECURITY*. There you have it, the root password to the Constitution. Illegal wiretapping, assassination, anything is now justified in the defense of our NATIONAL INFORMATION INFRASTRUCTURE. bd

1 0

On-Line Security Eyed For Florida St. ID Tool
by se7en 17 Dec '03

17 Dec '03

V-One Corp. said it will be supplying a key security component to the smart card identification and transaction system that Florida State University is developing. When the system, SmartWorld, is deployed later this year, students will gain access through the Internet to a host of applications touching on many aspects of campus life. Electronic financial transactions over the network will be secured through mutial authentication and encryption aided by the smart card. V-One said it will provide its SmartGate "middleware," which allows virtually any application to run securely on public networks like the Internet. The agreement also provides for cross-training between V-One and Florida State personnel, and V-One technology will be incorporated in demonstrations that Florida State's Card Application Technology Center makes in marketing its system to other universities and colleges, government agencies, and other organizations. se7en

1 0

Re: "Mail Exploders"
by vin＠shore.net 17 Dec '03

17 Dec '03

Wonderful tale! I can see that -- maybe, just maybe -- AOL or another targeted online community (a semi-moderated mailing list or even a semi-moderated newsgroup) could be slapped for just bouncing the SPAM back at the sender. I bet they could get away with it, however, if they appended a brief polite notice that this mailing exceeds some (anti-spam) perimeters that the subscribers of AOL (or other online community) agreed -- in their intial subscriber contracts -- to have AOL refuse for them. (Which text, of course, would add to the reply mail burden for the Spammer's IAP.) The only meaningful control on SPAM I can see is to start enforcing a chain of contracts that forbid it (without reference to content) from the backbone back through the IAPs to the users. (I think Long-Morrow at Yale had a nice paper on this a couple of years back.) But this sort of auto-return mechanism could make a dent on the super-Spanners now. Yea for AOL! Suerte, _Vin > On Nerd AOL using explosive mail, this Cyberia-L pointer: > > http://infolawalert.com/stories/061496a.html > > [Excerpts] > > Cyber Promotions sends a collection of short ads, written > as if they were newspaper classifieds, to upward of 900,000 > recipients, 600,000 of whom are America OnLine subscribers. > > America OnLine contends that its computer systems have been > swamped by Cyber Promotion's mass mailings, especially when > 5,000 undeliverable messages start to pile up each day. ... > > When the mailings continued, an AOL employee collected a > bunch of Cyber Promotions's undeliverable messages and > redirected them to UUNET, a large Internet service provider > used by Cyber Promotions. > > According to Cyber Promotions' complaint, this "stunt, > known as an 'e-mail bomb,' was knowingly and maliciously > sent to UUNET by AOL in order to severely tie up and/or > bring down UUNET's computer system." UUNET subsequently > cancelled Cyber Promotion's account. > > According to Cyber Promotions' complaint, AOL bombed > another service provider used by Cyber Promotions. ... > > > > > > Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

2 1

Re:Oil Change software snoops through hard drive
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Declan writes: > Alan forwarded this to me. Thought it might be interesting. -Declan [...auto updating software...] > Unanswered Qs: [...intersting questions which are raised by such a service...] I saw no mention of authentication between the Oil Change client and server, so the first question that I had was "how do you know if you are actually connecting to the legitimate Oil Change server?" Since the updates are via dialup a few bridge clips in the right location would be all it takes to have the call re-routed to someone else's server (and if the update is done over the net hijacking the system is not much harder...) Once you have people getting your server instead of the Oil Change server you _own_ their machine. You can install whatever trojan horses or backdoors you want under the guise of an update or direct the user to pull a hacked update from a server you designate (and it wouldly not be hard to set up a dummy software package so that even if you later lose your override of the system or remove it to cover your tracks the system continues to keep your backdoors installed.) This is some very bad mojo. A little social engineering or midnight wiring and there will be a lot of people in a world of pain. Nothing like designing a system which takes your weak spot and makes it a security problem for every one of your customers... jim

1 0