- cypherpunks-legacy - lists.cpunks.org

Re: Warning about Pegasus Mail and PGP (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 9 Dec 95 at 18:29, Siberia wrote: : Okay, here's how I understand things with PGP and Pegasus. You have two : options with Pegasus depending on the set-up options you choose. You can : either send upon completion of your out-going email, or you can have your mail : queued until you press the send out-going mail button. The actual PGP process : does not occur until you actually send the mail. So the answer would be: : don't queue your mail. That's not really a solution in the Windows environment, if you have a swap file, you never know what gets written out to it. The solution is run w/o a swap file or run an encrypted file system. I run an encrypted file system. Pegasus will indeed save your key with your message in the outgoing queue. This is a problem with the design of pegasus, not with the design of the add on encryptor. : : On 9 Dec 95 at 16:24, Jon Lasser wrote: : : > On Sat, 9 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: : > : > > I just installed the "Open Encryptor" PGP interface for Pegasus Mail. : > > I found that when you sign a message and queue it, it stores your password : > > in the clear on the hard drive. Apparently : > > it doesn't sign or encrypt the message until just before : > > transmitting it. So it stores your PGP private key password : > > with the message until it sends it. : > : > Can anyone verify this? : > : > Kinda brings new meaning to the term "Open Encryptor," huh? : > : > Jon : > ------------------------------------------------------------------------------ : > Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 : > Visit my home page at http://www.goucher.edu/~jlasser/ : > You have a friend at the NSA: Big Brother is watching. Finger for PGP key. : > : > : > : -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMpJNDUjeCeeebC9AQFsdAf+OY1FPLqSbHYyB+MnUl56dau9gFouoLKf y5UDCE9d4w2ndo6iKOGk7UzfTR3vYQaJmfEI2og+37hi2au01mHm/T0IAUOFYOYr owr6Xn8TZ8vHPOEe71LYRdad60ZdlkPr7H3Nxc9l7O9ueZp0SAM4xPMZmMPUkb8V d4j2m1kbLOHHNmqFmHWjxXvKLaowF/38cgbV9VuDFatySZuM9TdaVQEbazum0uDE LOgUzrQqs2GqlDOB1WMkvJv947SPHhjCJQTcygtS6SoGJv6AzLCL0LtstmBnCOgI zRIrX5wgFSp49BRdmE0/xp62+TuaGCZ6ml8iW/zS9ab7GSeOA2Qs6Q== =GINp -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Animals can be driven crazy by placing too many in too small a pen. Homo sapiens is the only animal that voluntarily does this to himself.

1 0

test
by Anonymous User 17 Dec '03

17 Dec '03

this is a test of the cypherpunk w3 anonymous remailer interface. author is N..... B...

1 0

Re: The Elevator Problem
by Daniel Miskell 17 Dec '03

17 Dec '03

There is an easy way to develop a secret key in front any number of eves, be they experts or not, without the eves knowing what the key is. Even if they tap your phone/comm line, ect. There was an article in Discovery Magazine a couple of years ago, talking about how to use photons and their randomness as the perfect, uncrackable code. Use of the photons aside, there was a key generation method discussed, simple, yet secure enough to work out on a tapped phone. Let me root around. Regards, Munster. --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

2 1

anonymous remailer
by Fred Nix 17 Dec '03

17 Dec '03

Hey... How do I gain acess to the remailer? Thanks! Fred Nix

2 1

Whew!
by Ed Carp 17 Dec '03

17 Dec '03

I just finished leafing through Schneier's "Applied Cryptography", second edition. Lots of new stuff, good and very thorough coverage of protocols and implementations, including weaknesses and processes behind same. If an idiot like me can understand this stuff (and if you don't believe I'm an idiot, just ask Perry), anyone can. I highly recommend the book, it's an absolute bargain at $50 USD. Should be required reading for anyone before being allowed to post here. :)

1 0

Re: GAK and self-incrimination?
by Greg Broiles 17 Dec '03

17 Dec '03

Tim May writes: >Consider this hypo: I send an encrypted message to a partner in crime >containing plans for future crimes and descriptions of past crimes. I don't >GAK the message. The government prosecutes me under the Anti-Terrorism and >Child Protection Act of 1997. > >My defense? That GAKKing the message would be tantamount to incriminating >myself, which the Fifth Amendment protects me against. The Fifth protects you against *compelled* self-incrimination - in particular, the right to be free from the "cruel trilemma" of o conviction of a substantive crime, based on your (true) testimony o conviction of perjury, for lying when asked to incriminate yourself o contempt of court sanctions, for refusing to answer but your hypo doesn't seem to create that forbidden situation. In particular, you're free to simply not send the message at all. (this message, sent from my Windows box, isn't PGP signed. Doh. signatures will return when the Unix box is net-functional again.) -- "The anchored mind screwed into me by the psycho- Greg Broiles lubricious thrust of heaven is the one that thinks every temptation, every desire, every inhibition." greg(a)goldenbear.com -- Antonin Artaud gbroiles(a)darkwing.uoregon.edu

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 9 Dec 95 at 21:43, Jeff Hupp wrote: > On 9 Dec 95 at 18:29, Siberia wrote: > : Okay, here's how I understand things with PGP and Pegasus. > : You have two options with Pegasus depending on the set-up > : options you choose. You can either send upon completion of > : your out-going email, or you can have your mail queued > : until you press the send out-going mail button. The actual > : PGP process does not occur until you actually send the > : mail. So the answer would be: don't queue your mail. > That's not really a solution in the Windows environment, if > you have a swap file, you never know what gets written out > to it. The solution is run w/o a swap file or run an > encrypted file system. I run an encrypted file system. Oh, PLEASE! Do you HAVE to go and mix up two completely different issues? Aren't the nontechnical people trying to follow these things likely to be confused enough without your adding to that confusion? For every person who really understands the technical issues there are probably a thousand or ten thousand who are just trying to *use* the stuff without stepping into a deep hole. An OS swap file is one kind of hole. What Siberia is writing about is ANOTHER type of hole. If I wipe my swap file after each use of my machine and don't know that Pegasus is doing this, or think that because of what you wrote I'm no worse off, I've been done a serious disservice. > Pegasus will indeed save your key with your message in the > outgoing queue. This is a problem with the design of > pegasus, not with the design of the add on encryptor. How about saying something USEFUL, like yes or no to the question of whether sending WITHOUT queueing will make any difference? How about agreeing that if David Harris hopes to provide a useful interface to external "encryptors" he will have to do something about this? How about cc'ing David? Somebody else could as well point out that we're all full of crap because we don't use Amigas, and while he might have a point, it wouldn't be a very useful one. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMq8MUjw99YhtpnhAQHA2wIAo72mzD7yNYy2btraeMg92hkekW/ik/hR SILC97a/gTGtZJiHV0MLcGETgZL51kFPQ3pRx+BGZl5g8JdRAQ2ZpQ== =gOtF -----END PGP SIGNATURE-----

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Dec 95 at 12:30, Anonymous wrote: : On 9 Dec 95 at 21:43, Jeff Hupp wrote: : : > On 9 Dec 95 at 18:29, Siberia wrote: : : > : Okay, here's how I understand things with PGP and Pegasus. : > : You have two options with Pegasus depending on the set-up : > : options you choose. You can either send upon completion of : > : your out-going email, or you can have your mail queued : > : until you press the send out-going mail button. The actual : > : PGP process does not occur until you actually send the : > : mail. So the answer would be: don't queue your mail. : : > That's not really a solution in the Windows environment, if : > you have a swap file, you never know what gets written out : > to it. The solution is run w/o a swap file or run an : > encrypted file system. I run an encrypted file system. : : Oh, PLEASE! Do you HAVE to go and mix up two completely : different issues? Aren't the nontechnical people trying to : follow these things likely to be confused enough without your : adding to that confusion? For every person who really : understands the technical issues there are probably a thousand : or ten thousand who are just trying to *use* the stuff without : stepping into a deep hole. : : An OS swap file is one kind of hole. What Siberia is writing : about is ANOTHER type of hole. If I wipe my swap file after : each use of my machine and don't know that Pegasus is doing : this, or think that because of what you wrote I'm no worse off, : I've been done a serious disservice.] So, I shouldn't take the opportunity to tell those non-technical people about the other "hole" they most likely have? After all this only effects Windows users and it is a problem with windows. Read what I wrote, I did not say the original post was in error about not queuing mail and saw no reason to repeat what appears to be a fact. And, if the non technical people don't know about the swap file problem, and just assume that if they don't queue mail they are no worse off then they have been don a serious disservice. BTY, did you check it out? Or just take what you saw as an opportunity to rant? : : > Pegasus will indeed save your key with your message in the : > outgoing queue. This is a problem with the design of : > pegasus, not with the design of the add on encryptor. : : How about saying something USEFUL, like yes or no to the : question of whether sending WITHOUT queueing will make any : difference? How about agreeing that if David Harris hopes to : provide a useful interface to external "encryptors" he will : have to do something about this? How about cc'ing David? : : Somebody else could as well point out that we're all full of : crap because we don't use Amigas, and while he might have a : point, it wouldn't be a very useful one. : Yes, it would have been a WONDERFUL opportunity to drop a O/S v. O/S troll on the list, notice I didn't. What I did do, was write up a problem description and mail it to David Harris. This based on the likelyhood that he doesn't read cypherpunks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMrgqTUjeCeeebC9AQG3gwf/VdD9J/KJ1Tau3/L8BLoZ1v6ACAc93zcP 4F1MDoeX7EMSjWqGFZvsh0ev9hgciXvId9lu7tfMqIXQdolHzjXiyPXaw3qEa1Id A80j+Z7OKB9RSz9LKHQqjrrqpANDbJ16LIztYW5r9YjMSntWX9OF7MzeZ0BJRYc4 d1oWnhHqnF6K9rX2XWDveXyQJgCnu2sZw6nNXi0V61OdhBc/QmPsjBp+u7aig+i8 vdC7EJh2znKsNqlQqiJmHnfTbGuoVZGQkc/71hpD2reLzcU7W/NQwM7rL4PFGyDg QA15LXcfKsp6p0JCdZc+bvUfpH5mQQFWm4kd6sY7knjO3fKuTc7jpg== =Li0A -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com A generation which ignores history has no past - and no future.

1 0

Re: More FUD from First Virtual
by Ed Carp 17 Dec '03

17 Dec '03

> From: Adam Shostack <adam(a)homeport.org> > Subject: Re: More FUD from First Virtual > To: jimbell(a)pacifier.com (jim bell) > Date: Sat, 9 Dec 1995 16:51:58 -0500 (EST) > Cc: cypherpunks(a)toad.com > jim bell wrote: > > [Good points about cost of transactions deleted] > > | The answer, I think, it that there would be no problem finding people to > | take that risk in exchange for the return, ESPECIALLY if they have some > | input into the design (level of security) of the system. They might insist > | on 2048-bit RSA keys, instead of 1024-bit, for example. > > (I know its only an example, but...) > > Key length is not what is needed for better security; more > solid code and better interfaces are needed. (I might also argue for > hardware keys that are more difficult to steal..) Nonsense. The code is pretty solid, the interfaces aren't very difficult. What is needed is better human management of keys. Why brute-force, why look for weak keys, why bother calculating how much safer 2047-bit keys are rather than 1024-bit keys when someone can look on your HD and find your secret key, when they can open your desk drawer and find your pass phrase or password, when they can guess that you used your wife's maiden name as your password? Adam, I don't understand why you wrote nonsense in the first paragraph, then followed it up with textbook attacks such as: > Cryptosystems fail because of bad storage of keys, coding > mistakes, accidentally writing passphrases to disk during a swap, etc. > Moving to 2048 bit keys is no help if you lose the key to a > non-cryptanalytic attack. Moving to keys with a week or day lifetimes > might be better. Moving the systems which automatically issue key revocation certificates, and coupling that with a wide distribution system would be the perfect match to such a scheme. Of course, that means that PGP et. al. needs to be more tightly integrated into existing mail software.

2 1

Re: Free calls to Govt (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I've been told that number is out of date. Since I forgot to save it, would someone who did check and find out? Thanks, -Allen

1 0