- cypherpunks-legacy - lists.cpunks.org

fnords
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

:: Request-Remailing-To: wilcoxb(a)nag.cs.colorado.edu Subject: Why I don't sign all my mail Latent-Time: +0:00 Cutmarks: #-- -----BEGIN PGP SIGNED MESSAGE----- Bryce - you write: > Thanks for the info, Bill. I have a question: why are you > sending e-mail in the clear and without authentication? > I don't expect that anyone would want to forge mail from you > to me, but I would be pleased if I could be a little more > certain of those things, and besides "Think of it as a form of > solidarity." Convenience, mostly. Encryption and signature are semi-different issues. If I clear-sign something, and you don't want to check it, it doesn't cause you any trouble, but for most people, getting mail that's encrypted takes extra work, especially if they're following proper security procedures for their PGP implementations (not running it on insecure systems, not leaving passphrases in cleartext for autosigners, etc.) Think of proper security as "solidarity with people who need real security" :-). (Yeah, I also run PGP on insecure systems, mainly for signature-checking, but I do use separate keys that have words like "insecure" in the userid strings.) The big issues are convenient interfaces with my email system. Private Idaho's gotten good enough that if I want to send encrypted/signed/etc. email, I can grab the mail I want to send into the clipboard (or compose it inside PI), add headers for who to send it to, pull down a couple menu items, and it pops into PGP; when it's done, another menu choice dumps the completed message back into Eudora, and the next version can send it out directly if I prefer. On the other hand, moving mail _from_ Eudora _to_ PI is still a couple actions (separate cut/pastes for the body, address, and Subject:), so I don't usually bother. The other convenience problem is key-handling for people whose keys I don't already have. PGP is too slow on a PC to haul the entire keyserver database into my pubkey files. So either I have to send email to a key-server (non-real time, especially since I do most of my email off-line), or use finger. Unfortunately, your key wasn't on the keyservers, and I don't have a decent PC finger client now that I'm using Trumpet Winsock instead of Netcruiser (the finger client I use doesn't allow cut&paste to the clipboard, screen-grabs didn't get me text, and I did eventually get most of your key information by doing several "telnet you@machine 79"s until one of them got the data before the session closed :-) Ugly... And then there's the key validation problem - your key isn't signed by anyone except yourself (yeah, ok, mine's only got signatures from previous keys of mine, which have signatures from expired keys from the people who signed mine :-) So my signature isn't as meaningful as it could be, since you probably can't validate it, and I can't guarantee having a valid public key for you to send you anything important. So I guess I need to go get my keys signed by a couple people, and so do you, and the next code project on my wait-until-3.0 list should probably be a recursive key-signature digger... Meanwhile, Private Idaho is at ftp.eskimo.com/u/j/joelm/, and it's now working with ViaCrypt-for-Windows as well as PGP 2.6.* for DOS. Thanks; Bill Stewart stewarts(a)ix.netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQBVAwUBMCMPB/thU5e7emAFAQFYPAH7BXuxp0BCWKg8v/Uv6QzUQKSix3Zff3Kw FzBeSgDNN9KrOHEaUmemDXcBmcRabyeZyxrFTcgypvwADai1SYA45w== =Ht4c -----END PGP SIGNATURE----- #-- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

SuperMac Sentinel: Customer Support tale
by Russell Whitaker 17 Dec '03

17 Dec '03

jfg(a)fuente.engr.sgi.com (John Gibbon) wrote: >I got this from a friend, who got it from a friend, > who got it from a friend ... > > -------------------------------------- >SuperMac records a certain number of technical support calls at >random, to keep tabs on customer satisfaction. By wild "luck", they >managed to catch the following conversation on tape. > >Some poor SuperMac TechSport got a call from some middle level >official from the legitimate government of Trinidad. The fellow spoke >very good English, and fairly calmly described the problem. > >It seemed that was a coup attempt in progress at that moment. However, >the national armoury for that city was kept in the same building as >the Legislature, and it seems that there was a combination lock on the >door to the armoury. Of the people in the capitol city that day, only >the Chief of the Capitol Guard and the Chief Armourer knew the >combination to the lock, and they had already been killed. > >So, this officer of the government of Trinidad continued, the problem >is this. The combination to the lock is stored in a file on the >Macintosh, but the file has been encrypted with the SuperMac product >called Sentinel. Was there any chance, he asked, that there was a >"back door" to the application, so they could get the combination, >open the armoury door, and defend the Capitol Building and the >legitimately elected government of Trinidad against the insurgents? > >All the while he is asking this in a very calm voice, there is the >sound of gunfire in the background. The Technical Support guy put the >person on hold. > >A phone call to the phone company verified that the origin of the call >was in fact Trinidad. Meanwhile, there was this mad scramble to see >if anybody knew of any "back doors" in the Sentinel program. As it >turned out, Sentinel uses DES to encrypt the files, and there was no >known back door. The Tech Support fellow told the customer that aside >from trying to guess the password, there was no way through Sentinel, >and that they'd be better off trying to physically destroy the lock. > >The official was very polite, thanked him for the effort, and hung up. >That night, the legitimate government of Trinidad fell. One of the >BBC reporters mentioned that the casualties seemed heaviest in the >capitol, where for some reason, there seemed to be little return fire >from the government forces. > > > -- Russell Earl Whitaker whitaker(a)sgi.com Webmaster, Silicon Junction Silicon Graphics, Inc. Mountain View, CA =============================================================== http://reality.sgi.com/employees/whitaker

1 0

RE:NRC Panel, Law Enforcement questions
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hello Jim, I apologize that I didn't answer immediately. I have subscribed to several mailing lists and sometimes get some hundred mails a day. I don't have the time to read everything and therefore I have to select. I didn't read this thread, but I found it in my archives. > I wonder, and perhaps my kind friend Hadmut can help me here, if there is > an English translation of any and all Nazi-era German laws/regs regarding > cryptography. As I [dimly] recall, Enigma was born as a private enterprise > and the patent was only later taken over by government and classified after > it was offered for sale to businesses (without much luck). These laws, if > they exist, might make for interesting reading in side-by-side comparison > with either Sen. Grassley's latest proposals, or with anything regarding > cryptography coming from our paranoid FBI director. I fear I have to disappoint you. :-( First of all I don't know of any english translation of such laws. The only english translation of law I know about is the translation of our current basic law. It might be easier to find english translations in english or american libraries than in german libraries. Second, I don't know whether they had a certain law about cryptography. AFAIK Enigma was a commercial product first and was taken over by the government. But I don't know they way they did. Third, there was no need to have laws. I don't want to restart the discussion, but the Nazis didn't understand laws as so important. I have read a book about their justice some time ago. The 'idea' and the 'public feeling' was seen as more important than laws. But perhaps another telecommunication law may be interesting. It was forbidden to receive foreign radio senders. If they came into the house and the radio was tuned to foreing frequencies, you got into serious trouble. I just don't know where to find the text of the law. regards Hadmut

1 0

Re: Java and Safe-TCL security
by Rich Salz 17 Dec '03

17 Dec '03

>One problem is that safe-tcl >was oriented around email, so it lacks facilities for accessing web >pages. No, it's just that the people who took it over^H^H^H^Hand ran with it were most interested in email. My initial motivation was that I wanted to write a new news server that clients could download programs to. /r$

1 0

JAC_kio
by John Young 17 Dec '03

17 Dec '03

8-6-95. NYPaper Book Review: "Spies Unlike Us: A history of French intelligence reveals a far more brutal approach than this country's." The aftermath of 1945 imposed an additional heavy burden on the French secret services. Political allegiances were exacerbated by the presence of a potential huge Communist fifth column in France. The rough lessons of the war led to a premium on "service action" operations of sabotage and assassination before which Britain's M.I.6 would have quailed. Mr. Porch sees the French secret services of today as still not having recovered from their politicization during World War II. During the gulf war, the humiliating realization was forced on the French Army that for intelligence it was totally dependent on American high technology. SAL_mai "The Code War: How United States intelligence outsmarted Japan in World War II." He rightly sees the role of intelligence in the Pacific war not simply as a story of code-breaking successes. Rather, he writes, "the true achievements of intelligence in the Pacific war lie in the day-to-day accumulation of a fund of knowledge.... Cryptography, traffic analysis, aerial photography, prisoner interrogation, document capture and translation, and technical intelligence ... became pillars of an overall effort greater than the sum of its parts." He explains and describes this winning synergy of intelligence elements as well as, or better than, any previous author. PIL_sal Jak/Ari: JAC_kio

1 0

Two-faced Security Problem? Dammit Janus?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Not exactly crypto, but the same idea: I've been trying to hook up an HTTP server sitting on a Mac at the end of my normal PPP connection. This was just supposed to be a test, but I kept getting annoying connection problems whenever someone tried to GET a page from me. The connection wouldn't go through about half of the time. After poking around for a week, I discovered that my home machine, newray.digex.net, is listed in the Digex's nameservers TWICE! Once with the IP address that my home machine is waiting for (199.125.128.5) and once with some other IP address in the digex space (164.109.211.61). If you do an nslookup on the name, you get both addresses. I believe that the technically correct thing for someone to do is to choose one of the addresses at random to distribute the load between two machines pretending to be one. This explains the connection failures that happened half of the time. This has led me to wonder, though, whether this is some sort of security breech. For instance, could there be someone out there mascarading as me? Normally I run Eudora, Netscape, Telnet and other outward bound applications. It was almost a fluke that I noticed that there were two entries. Does some software need to find its IP address in a DNS table? For instance, does Eudora need to look up 164.109.211.61 to find "newray.digex.net"? If someone was using this software on the mascarading node, they would need to set up an entry in the tables to make everything work. They just assumed I would never get inbound traffic. Any theories on this? -Peter "More Paranoid Than Ever" Wayner

1 0

Re: MS Money password problem
by dochobbs＠wwa.com 17 Dec '03

17 Dec '03

I'm not sure if this has been mentioned or will help, but this company makes crakers for quicken, word and wordperfect (not sure about M$ money though). http://gn2.getnet.com:80/crak/ email: johnk(a)indirect.com _____________________________________________________________ dochobbs(a)wwa.com M.D. Hobbs mhobbs(a)rad.rpslmc.edu http://miso.wwa.com/~dochobbs finger for my pgp key I am human and nothing human do I count alien.

1 0

RSA Catalog
by John Young 17 Dec '03

17 Dec '03

For those who've not yet fondled RSA's sleek "Security Solutions Catalog," it can be virtually diddled at: http://www.rsa.com/rsa/sscatw95/P67.HTM

1 0

Re: Where to find Internet growth stats?
by brendan＠Mail.RAth.PeachNet.EDU 17 Dec '03

17 Dec '03

http://www.tic.com/mids/midshome.html is --cut->>Matrix Information and Directory Services, Inc. (MIDS) is a corporation founded by Smoot Carl-Mitchell and John S. Quarterman. Eric McKinney is Assistant Editor. <<--paste- --- Brendan Mullen brendan(a)chugalug.cosmic.uga.edu Athens GA USA

1 0

[Meaningless] Vote.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Fellow Cypherpunks: Below is the URL of an "Online Forum" page to allow 'Net citizens vote on various, (usually boring) issues. >************************************************** > VOTELINK brings the Voice of the Internet > To today's hot news topics. To make your voice > "heard round the world" go to: > > http://www.votelink.com >*************************************************** So last week I was surfin', wastin' time, and drinkin' a brew, and I happened by. I was asked to vote on some mundane topic [I forget what]--and instead I suggested a "World Vote" topic I liked better, and, sure enough, they put it up this week: [I was shocked when they e- mailed me!] :-) >Should Phil Zimmermann be prosecuted for allowing > release of his PGP encryption program on the > Internet? > > > PRO: ITAR export restrictions exist. > Cryptographic software, like PGP, is > considered a weapon of war. -- more [somebody shoot me with PGP, and nothing else!] > > CON: Imprisoning Zimmermann for export > violations would be an unconstitutional restraint of > free speech and privacy rights. -- more [guess how Jim Ray voted...] ;-) OK. Far be it from me to suggest vote fraud [there aren't too many Libertarians in cemetaries anyway :)] but I think certain cypherpunks might want to go "vote" this week, if you have the time to waste. Please vote *only* once, and tell all your buddies. Thanks. JMR - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMCbswG1lp8bpvW01AQGDeAP8DZiWwIsABi7sy3MuyZo5QMFB/lf0ghIg 8zcE/WGaPocvwqlxwBW3DckSQw/vM8cqyv3LGPjQwC2il5HpELdyS44Rd4tQ/Qjb p0P+6mZh0Qk8domUuadX877Lk8hcnh7ydypCL3WPigSvh3tYYGwnL00Q6vi6nKzj YQ7092OOn80= =ebKB - -----END PGP SIGNATURE----- Regards, Jim Ray "The people will again respect the law when the law again respects the will of the people." Jim Ray, Campaign '92 - ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 - ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCbtzyoZzwIn1bdtAQHUowGA1pSgF1+AVBDi0Jz8H7dd4XIvbXNulPvF SIRzwHrNMApJoz2mX34r+8hndI3nwREW =hz/N -----END PGP SIGNATURE-----

1 0