- cypherpunks-legacy - lists.cpunks.org

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Everyone's talking about encrypted telnet. Has anyone at least READ the Kerberos FAQ? It's been in use for a while, and, to quote... > Kerberos is a network authentication system for use on physically > insecure networks, based on the key distribution model presented by > Needham and Schroeder.[3] It allows entities communicating over > networks to prove their identity to each other while preventing > eavsdropping or replay attacks. It also provides for data stream > integrity (detection of modification) and secrecy (preventing > unauthorized reading) using cryptography systems such as DES. > Practically speaking, Kerberos is mostly used in application-level > protocols (ISO model level 7), such as TELNET or FTP, to provide user > to host security. It is also used, though less frequently, as the > implicit authentication system of data stream (such as SOCK_STREAM) or > RPC mechanisms (ISO model level 6). It could also be used at a lower > level for host to host security, in protocols like IP, UDP, or TCP Being more 'official' than PGP, only a totally export-safe version has got out to ftp.funet.fi. Of course, it could be possible to patch PGP or something else into Bones, as the non-encrypting Kerberos is called. > An experimental Telnet Authentication Option has been > defined, and is described in RFC1416. (see also RFC1411). > These RFC's only define how > /authentication/ is to be performed; the standard for full encryption > is still under development. > An implementation of Kerberos V4 telnet is available via anonymous ftp > from ftp.uu.net, in /networking/telnet.91.03.25.tar.Z, but it predates > The IETF Common Authentication Technology Working Group is > currently defining security extensions for the FTP protocol. An > Internet Draft describing their work, and the source code for a > modified ftp/ftpd with the extensions, are now available > thumper.bellcore.com:pub/lunt/ftp.tar.Z > net-dist.mit.edu:tytso/ftp-wg/ftp.tar.Z ----------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -----------------------------------------------------------------------

1 0

PGP (surprise, surprise..)
by jmueller＠gac.edu 17 Dec '03

17 Dec '03

Greetings, Could anyone tell me, is it true that PGP 2.3 was watered down to appease the RSA folks? If so, would it be a better idea to use 2.2? Thanks. -- Joel Mueller - <Insert your favorite witty quote here; I'm tired.> GAT/O -d+(---) -p+ c++@ l+ u++ e m+ s+/- n- h-- f+@ g+(-) w+ t(--) ry? PGP 2.3a Public Key : finger jmueller(a)gac.edu or on keyservers. 0C6D75 01 0E 16 A7 29 C4 48 75 54 CD 99 09 88 88 3C 39

1 0

Reality
by TCJones＠DOCKMASTER.NCSC.MIL 17 Dec '03

17 Dec '03

Yes, we are watching you!!!!! L. Detweiler

1 0

keeping secrets from myself
by cort＠ecn.purdue.edu 17 Dec '03

17 Dec '03

Here is a practical problem that has me frustrated.... Situation: Assume that I am the treasurer at my local church. This implies responsibility to record each Sunday's offering (the money collected) in the church financial books. An account is maintained for each member of the church. Money received from members each Sunday is credited to their respective accounts. Each January, a report is prepared for each parishioner showing a summary of the charitable contributions for the previous year. This information is used for tax purposes. Currently, the treasurer knows EVERYTHING about EVERYONE (regarding charitable giving). As a privacy advocate, this is indeed uncomfortable (for giver and treasurer). Problem: I want to know as little as possible about church member giving. Give and Take: It will be difficult/impossible to prevent the treasurer from seeing each weeks' checks. However, a privacy improvement may be achieved if the running totals are kept hidden. How can I provide a comprehensive year-end statement to each parishioner while maintaining maximum privacy? Does cryptography have anything to offer to this situation? What procedures/protocols could be implemented? What privacy enhancements could be included with the church accounting software? Cort.

1 0

EFF's Barlow v. Denning on Clipper - AOL March 10, 9PM EST LIVE
by Stanton McCandlish 17 Dec '03

17 Dec '03

CLIPPER CHIP DEBATE Thursday, March 10, 9 pm eastern Dorothy Denning, cryptologist and chair of the computer science department at Georgetown University, will debate John Perry Barlow, cognitive dissident and co-founder of the Electronic Frontier Foundation, in the TIME Odeon on America Online this Thursday at 9 pm. Philip Elmer-DeWitt, TIME senior writer, and Robert Pondiscio, TIME public affairs director, will moderate. The floor will be open to questions from the audience. You need an America Online account to participate. Call America Online at 703-448-8700 to subscribe. Philip Elmer-DeWitt ped(a)panix.com ped(a)well.com TIME Magazine philiped(a)aol.com Read TIME on America Online, where we get paid to take abuse. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

2 1

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

all this about newbies>> i for one am a newbie,, gee i hate that word,, at least to this list. though i have been in and around computers since 81. over 13 years now most of what i have been around is the bbs, and programing, and hardware of computers. also i am an information freak from early childhood. the major pitch of my crypto has been word based, not computer based but i understand the princibles behind it. though my main concern of late has been the up swing in government and criminal investigators involment in the computer field. most notablly with the clipper and other chips. i have always been a privacy advocate. having done things in early youth that in a world ruled by "big brother" i would surely be targeted for. i do not want the US of A or most of the free world to be ruled by "big brothers" that is why i read this list and others. yes in the past i have posted rants, and raves. but that is life. i talk the good ole heart and soul while others talk the techno ascept of the issues at hand. ' charles the monster maker

1 0

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

re the issuing of smart cards in france. when will we in the US of A be issued our ID card? already in some states you hve to have so much id just to get a drivers liscence that it is not funny. recently my fiancee lost her date book, for her it is a purse anything about her that would be needed to form another history via id was in there. and being adopted she did not have a copy of her birth certificate.. makes you wonder if the "smart card" is reaaly the better idea. to make it seem good to folks, lets have encryption in the card we can access certain parts of the card, via our own password, given it would have to be a hard to get password, something like 2BeoR^3%iT in at least 10 charactors long. we could all have them hooked to our money supply that would cut down on the fake card/money/credit business a bit and give us more ability to be controled by the governing bodies if we fail to pay the IRS one year, they could just take it out at their stations in the big office at the IRS building. or even the voting, pass it through the voting booth reader and key int he ones you want to help control your life. neato,, do away with all the bulky change i carry around too!! charles the monster maker

1 0

Pondering Clipper
by Adam Lake 17 Dec '03

17 Dec '03

Heard enough about Clipper? I have been receiving cypherpunk material for about a week now. I am new to cryptography, and new to security(feel free to laugh). I hope this posting is appropriate.. Well enough excuses for what I am about to say but I might like Clipper. 1.) From what I am hearing (largely propaganda from both sides) Clipper will be OPTIONAL. If I am businessman X and I dont know squat about security (but realize it is a good thing) wouldnt I want something I could feel secure with? For me, wouldnt Clipper be a good thig? 2) If, for some reason, I wanted to keep something even more secure so the government couldnt see what I was doing, couldnt I just encrypt a message before or after it goes through the Clipper Chip? I would think this would prevent the government as well as anyone else from reading my message en route 3) Right now I can pick up cellular phone conversations and intercept data through any network lines with a datascope. For anyone who doesnt wan this to occur wouldnt it be nice if they couldat least be reasonably certain that no one could understand what they are hearing or seeing? 4) Also, would it be unreasonable to have an on/off switch on the Clipper chip? Please dont assume me to be a pro-clipper individual. I am merely trying to form a logical, educated opinion on the issue. I will always feel skeptical when the FBI say we just need this to maintain our current state of survellience capability (or is that survellience state ;-) And I am also aware that if anybody thinks these keys will be kept confidential unless the government has a warrant blah blah blah well I better stop there.......... lake(a)uenics.evansville.edu ---------------------------------------------------------------------------- Space for rent ----------------------------------------------------------------------------

2 1

Royal Bank privacy waiver
by marc＠tanda.isis.org 17 Dec '03

17 Dec '03

Gentlefolk, The following is in light-grey small print on the back of the current Royal Bank Visa Gold card application. It appears to be an attempt to end-run privacy legislation. The net is that using your Gold Card gives the Royal Bank, and anyone else it chooses to share information with, permission to do what it wants with any information about you that it has, has ever had, or ever will have; even if you are no longer a client. It is worth the read. ... I will comply with the Cardholder Agreement you will send to me when you issue, renew or replace my card. If I sign, use or accept my card, it will mean that I have received and read the agreement. It will also mean that I have understood and agreed with you to everything written there. You may collect credit and other financially-related information about me (Information) from me, from credit bureaux and from other parties. You may use information as follows: - You may give it to credit bureaux and other parties who have or may have financial or other business dealings with me: - You may use it to determine my financial situation; - You may use it for any purpose related to the provision to me of services I request from you. You may also give it to anyone who works with or for you, but only as needed for the provision of those services; - You may use it to promote your services to me. You may also add it to client lists you prepare and use for this purpose; and - You may share it with your affiliates (where the law allows this), in the form of client lists or otherwise, so that they may promote their services to me. If I have ever given you my social insurance number, you may treat it as information and use it as an aid to identify me with credit bureaux and other parties. Even if I am no longer your client, you may keep Information in your records and use it for the purposes noted above. If a co-applicant signs this Application, they also agree and consent to everything written here and in the Cardholder Agreement. .... At the bottom of the page, in bold black letters, for comic relief, are the words "RESPECTING YOUR PRIVACY IS IMPORTANT TO US". Cheers, Marc --- Marc Thibault | Any warming, global Automation Architect | or otherwise, is Oxford Mills, Ontario, Canada | welcome. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQA9AiyT2YcAAAEBgKVboQejsR2t2U70HoWOXTIqlWUCRGkTht8Yn/4kuzWby/e3 Z9tT8RHJbAx9us7QZwAFEbQdVGFuZGEgTWFpbCA8bWFyY0B0YW5kYS5vbi5jYT4= =aFhG -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Coming Police State
by Brian D Williams 17 Dec '03

17 Dec '03

Duncan, I live in Chicago, let me know if you'd like to get together for a Pizza, cocktail, or whatever. I could also give you a place to check your mail (via telnet etc) Brian Williams Ameritech Data Center 425 w randolph Chicago Il 312.669.2373

2 1