- cypherpunks-legacy - lists.cpunks.org

RE: Cash
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>>On Fri, 18 Nov 1994 wcs(a)anchor.ho.att.com wrote: >> >>> Hasn't really provided it for quite a while, as long as there's an >>> infrastructure to track serial numbers (you've presumably noticed that >>> each bill a unique serial number, except for counterfeits and maybe >>> printing glitches.) >> >>And every bill that passes through my hands (of course not the ones I >>handle at work, I'm talking personal here...) gets the serial # >>overwriten in heavy black marker. >> >>Happy Hunting, -Chris. > >I went to a GSA auction and picked up 3 very nice U.S. Gubment surplus >paper shredders. They shred into very fine particulate that makes great >fire starting material for the fireplace. >I run everything with my name, address, etc., thru it so that *none* of >my trash is identifiable. >How's that for paranoid :> > How much would you want for one of them, assuming there's one for sale? Dave "Getting more paranoid by the minute, sometimes" Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Secure EDI over Internet
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Summarized from PC Week, Nov 28th, page 44: -begin- Premenos Corp now testing product to foster Electronic Data Interchange transactions over the Internet. Technology licensed from RSA Data Security Inc provide the security features, encryption, authentication, and guaranteed message delivery. Carl Redfield, VP of manufacturing for Cisco Systems Inc, was quoted as saying, "Security is the most important factor to us, as it is now, anyone could intercept messages off the Internet." Cisco is involved in testing the new product. The Premenos suite will be available first quarter 95. Pricing not set. These phone numbers were given for more info: Premenos (800) 426-3836 Cisco (800) 553-6387 -end- regards, -pd-

1 0

RE: Cash
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

>On Fri, 18 Nov 1994 wcs(a)anchor.ho.att.com wrote: > >> Hasn't really provided it for quite a while, as long as there's an >> infrastructure to track serial numbers (you've presumably noticed that >> each bill a unique serial number, except for counterfeits and maybe >> printing glitches.) > >And every bill that passes through my hands (of course not the ones I >handle at work, I'm talking personal here...) gets the serial # >overwriten in heavy black marker. > >Happy Hunting, -Chris. I went to a GSA auction and picked up 3 very nice U.S. Gubment surplus paper shredders. They shred into very fine particulate that makes great fire starting material for the fireplace. I run everything with my name, address, etc., thru it so that *none* of my trash is identifiable. How's that for paranoid :>

2 1

Re: "You aren't following the _rules_!"
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: >I have little means of solving the Netcom-Macintosh-elm-Eudora issues, >and I don't see others solving them especially cleanly or usably, so I >expect that the "sign your messages or else" dictum would have a >predictable result, for me. I don't want to restart the "If the output wont work on a stack of Hollister cards the system sucks" thread, but Tim is here, as he is most of the time, right. After two years, we still have not made it much simpler to integrate PGP/whatever into a mixed OS environment. >And isn't it up to the _readers_ to decide if they don't want to read >my messages because they think I'm not being diligent enought, or >because my messages appear to be forged? Few readers on this list would think that Tim is not dilligent enough. A forged message would not be able to fool us for long. The problems is that is no simple way to integrate PGP with the many newsreaders, mailers, etc., that are being used on the net. This is unlikely to change until there is a new, acceptable, RFC for mail that implements digital signatures and encyption (if desired) without user intervention. >Isn't end-user choice the core of the Cypherpunk ethos? Yes, choice is what Cypherpunks are (I hope) about. Choice through crypto. Unless crypto spreads we will face ever reduced choice. Crypto will not spread unless there is a demand. Most people, including one of (the?) leading thinker(s) of the group on the net that most supports cryptography believe that the added security and privacy that cryptography provides are not worth typing a few commands or clicking a few buttons. I myself rarely, if ever, sign my post. If WE don't even use crypto ourselves, who do you think else uses it and who do you think will therfore care if the government chooses to outlaw it? We don't have a motivation to use crypto. We all realize that there is really no need to encrypt/sign the vast majority of the stuff we are sending. There may be the occasional message that we will encrypt and we are well aware that we encrypt that message for the very reasons that the powers-that-be want to see encryption outlawed. There are no better tools for integration of crypto today, because there has been no need. The few times you actually need crypto you can punch the commands "by hand". I do not mean to belittle the work that has been done, but unless the encryption is built into the mailer and using a remailer means clicking the "use X remailer(s)" button, and the mailer better know which ones are working and do the PGP envelopes, it won't happen. Hell, I have been on this list for two years and today I decided against posting that updater everyone was begging for to USENET because I didn't want to spend the 15 minutes it would take me to look up the address of a mail-to-usenet gateway, find out which remailers are working, binhex the thing, and past it into the remailer interface. Yes, I know the 3 or 4 URL's it would take to do all that. Suppose the world will have to wait until that computer makers's FTP site is up again. <No, I don't see anything wrong with posting software that is available via FTP to USENET. Flames -> /dev/null> We are stuck: No need -> no development of tools -> no spreading of crypto beyond the "hard core" -> no public resitance when crypto becomes illegal. So how can we prevent crypto from becomming illegal? Just follow the above chain backwards. Create a need. Create mailing lists that require signed messages. Create ftpsites that require signed uploads or whatever. Require the use of crypto. Not to partake in some involuntary interaction with the government (that will happen without out help), but for some voluntary interactions between people on the net. Sending mail to cypherpunks is such a voluntary interaction. Requiring it here just might result in better tools in the long run. Just an idea, if it sounds like garbage, forget about it. - -Lucky, who wouldn't think of signing this post and only does it to show that requiring it for posting just might get people to do it. -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLtrswASQkem38rwFAQFZ0AQAixcrK7wNFJzisuA3v8FefURUt05NYj23 AyJw9TVoyWuo4gdDiao1/3dC43ZIgVSvTTGXKZ8cy5a4YcFyMLMEKumNfyn7FM/l PLzcOYXfCWp2/KlfY4cQs4nlUEDvheiTmgXE+2VRle00WHwL+ctm/Tx1i/mxD3BS 7Zo79IIOQyg= =ZSOT -----END PGP SIGNATURE-----

10 13

PGP & Elm
by CyberDrunk 17 Dec '03

17 Dec '03

I've been a lurker here on this list, but I am currently trying to get PGP working with elm in a way that will be convenient for users who use PGP and won't mess with the ones who don't. To make this short, I haven't been able to find much documentation. Can anyone point me in the right direction? wendigo(a)mars.lib.iup.edu

1 0

Re: Transparent Email
by adam.philipp＠ties.org 17 Dec '03

17 Dec '03

>I think it's a bad idea to require signatures on the list, or even to >penalize people who don't use them. People aren't signing their posts >because it's too much of a hassle to do it from a dial up, netcom style, >account, not because they're insufficiently committed to the cause. > >The real solution is to try to build tools which will make it so easy to >use crypto that there's simply no reason not to do it. I whole heartedly agree! Thank you Alex for pointing out the real issue. ObPlug: (I am currently writing a handbook on what intellectual property law can be used for when developing crypto systems, either to make a profit or to keep them free from commercial entanglement.) Tomorrow (San Diego Cypherpunks meet at Hops) I was planning on asking Phil Karn what Qualcomm was planning with Eudora as far as any PGP hooks, or if we need to to get of our rear-ends and design a mail application that will implement PGP for all the SLIP users on Windoze & MacN'trash systems. Sure there are those of us who can use LINUX and various scripts to bring PGP into our mailers, but a well built app that would get PGP to the lay people who want their privacy is needed. So, Cypherpunks write code. o Get off our collective asses and write something for: SLIP / PPP in windoze, mac, ( & warp?) o Make it free, widely available, and either stand alone, or compatible with Eudora. o Collectively demand that Qualcomm do something or else... o See if there are any software companies willing to take up the challenge. o Meanwhile, see what works for people... Create a contest for who has the best system for ELM, PINE, EUDORA, etc... o What about windoze scripting? PCTools for windoze scripting? Other scripts? I am willing to help, but I'm in the middle of Law school finals so any help will be delayed... Adam -- PGP Key available on the keyservers. Encrypted E-mail welcome. SUB ROSA: Confidential, secret, not for publication. -Black's Law Dictionary GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++--

1 0

SecureDevice/X-Windows
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Okay, so I'm signing my messages now. At least your proposed sign-or-delay rule has had its intended effect on one user here :) My question is: What is the group's opinion on the use of SecureDevice to store sensitive data as an encrypted volume under DOS on a PC? (I am assuming here that enough people know what I'm referring to not to explain.) I've moved all my email, sensitive data files, and PGP keyrings over to this new volume. Given all that I've read on the IDEA encryption method, I feel comfortable that the data is essentially secure from everything but a brute force attack on the key, or carelessness on my part. I'm sure that the magnetic fingerprint of the original data files still remains scattered over the rest of the hard disk, but I'm not as worried about this (yet--the more I read this list, more paranoid I seem to get :) Someone posted about using CFS under Linux to store his PGP secret keyring, without a keyring pass phrase. The idea here was that when the system was powered off, CFS provided sufficient security to protect the secret keyring. This would allow the user to automate the use of PGP with scripts to send and receive encrypted mail, without the need to deal with piping in or otherwise supplying a pass phrase. Would anyone consider this foolish? I can take the same argument here with SecureDevice--I only 'login' to the drive with my passphrase when I am using it, and when the machine is off, the encrypted volume protects the secret keyring by default. The weakness here is that should I step away from my machine and carelessly forget to 'logout' of the secured drive, my secret key is wide open for someone to steal. On an entirely different note: I use MS-Windows on the PC platform for my internet access due to the variety and relative availability of Windows Sockets based software. Call me a traitor to the cause, all Microsoft bashing aside, but I really do prefer the GUI interface to mail, FTP, telnet, and WWW than the Unix command line oriented tools to do the same. I also have Linux installed on a different machine, and am slowly learning all the neat and wonderful things one can do with it. I haven't quite gotten X Windows configured properly, but I wonder if all the same internet access tools I mentioned exist as X apps. This would allow me to get all the benefits of Unix, while retaining the ease-of-use benefits of a GUI environment. Forgive me if these are naive questions--I'm a lowly DOS/Windows user just now starting to see the light of Unix :) Another question: How feasible would it be to build a system under Linux/X Windows to automate PGP encryption and signatures in a transparent way, using an X windows mail reader? People have done this with Pine/Elm, so I assume the same techniques would work under X. Gosh, really showing my ignorance here :) - ----------------------------------------------------------------------- Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan - ----------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLtr+6E1Diok8GKihAQFGLgP/e2BN0W+QOpRwnj7JmIVUgl0cQaNeXpTS tvSmarhiSSQy6+6uC7XdOHWlJJ8qavbwr8LguMTcFIU8LFSp0jCiQcUj5Jxt9oSV evpeZXucwXsT/kh3m97MRiwqOxkjFED1h7zjKbJrHxdI/TkGPUXUmP815Am6eVqB qwY9W3lqeSs= =n+Df -----END PGP SIGNATURE-----

1 0

Re: Transparent Email
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric wrote: >I am still considering the "sign-or-delay" proposal for the toad.com >server, that is, sign your articles to the list or they'll be delayed >and eventually rejected. Do it. Either it will work or it will kill the list. If it works, geat. If it kills the list, we would have failed in our mission anyway. - --Lucky -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLtrCYASQkem38rwFAQHTFgP/VrP8GACjMT4amw7Ws1+VP0HftgZUtCGW +xP59b4FDVUuZH/KH0Q0t9eGYyHBqYlhkr3M4eU/149+Q6Jz7u/juOXx5W638UKB Ujz4Mf4MnBHaEU5/famKmFTD/n+dGS2Gzds121SLnW3rmVU2rPcPYBRkvYAQQZ+f Q//TPjhoj5Y= =3+9F -----END PGP SIGNATURE-----

8 7

Re: Transparent Email
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think it's a bad idea to require signatures on the list, or even to penalize people who don't use them. People aren't signing their posts because it's too much of a hassle to do it from a dial up, netcom style, account, not because they're insufficiently committed to the cause. It seems to me that such a rule would stifle discussion and encourage people to store their keys on insecure accounts. The real solution is to try to build tools which will make it so easy to use crypto that there's simply no reason not to do it. And towards that end: I think Eric's point about separating key distribution from encryption finally sunk in. It's encouraging for me, because I think we're very close to being able to implement good transparent systems, at least if we put key distribution on the back shelf. I haven't totally thought it through, but it seems to me that it's almost a matter of assembling a few existing tools into a coherent system. I've just installed Raph Levien's premail as /usr/lib/sendmail on my system, and I'm happy to report that it's running well, despite the fact that my machine is a very puny linux box. This means that I can keep a list of addresses that ought to be encrypted in my ~/.premailrc file, and outgoing email to those destinations will be automatically encrypted and signed, no matter what mail software I happen to be using. This leaves the problem of passphrases for outgoing signatures and automatically decrypting incoming mail, but I think that cfs will let me kludge something together which will get around this. (My situation is a little unusual, because I'm running linux on a pc which is connected to the net via a static slip account. I don't think this would work well in other situations.) If, after I power on my machine, I mount an encrypted directory with cfs, and then connect my slip, I think I can get away with keeping my key unprotected with a passphrase as long as the keyring is stored in the encrypted directory. What's more, if my mail spool is stored in the encrypted directory as well, a filter which automatically decrypts incoming mail and deposits the plaintext in the spool would be feasible. A good filter would probably stick something in the text to let you know that it had come with a good signature. It would be sort of ugly, but I think it would work. I'm sort of new to cfs, though, and I'm sure how it would deal with multiple users (root, my main account, my cp account which recieves cypherpunk list traffic, etc.). But If it worked, I'd have a machine which: o talked to the rest of the email universe without difficulty, and which uses standard unix software o would automatically use crypto when sending mail to a list of email addresses, and which could automatically handle incoming crypto o would be reasonably secure when it was powered off == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtrgPREpP7+baaPtAQHTlQP/RYcJi9u5iU0AY4SV1MqNGxAuQDfYwL2G LcJC5sxYreFGkpwwpA87fRcLi7PreAtS6vFg5tsMXiUXaNS15v1mCDfxr54AwO7C P3yyHWUTGg1I8CRbDUYlZqksrF3Bqzxy0pDRQGzPEFwP7k8ER72XXeVtIVc8K/zM CBW+smDOY/w= =43eM -----END PGP SIGNATURE-----

4 5

Re: Zimmermann interrogated without counsel
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 12:57 AM 11/27/94 -0700, Philip Zimmermann wrote: > >The following is a letter from Ken Bass, who is one of the lawyers on >my legal defense team, to US Customs. It is mostly self-explanatory. >It concerns the PGP investigation. Time to start travelling via Canada. DCF

1 0