- cypherpunks-legacy - lists.cpunks.org

Re: Crippled Notes export encryption
by Herb Sutter 17 Dec '03

17 Dec '03

At 20:32 01.17.1996 -0500, Perry E. Metzger wrote: > >Alan Pugh writes: >> infoMCI (sm) >> Lotus-Security - Lotus Announces Compromise for Export of Strong >> Encryption > >So, Lotus thinks they can fool people by back-dooring in key escrow, eh? > >Time to break out the artillery. > >Perry Careful... what would YOU have done, with your customers demanding stronger crypto today and you unable to legally give it to them? Again, folks, try to remember that this is NOT key escrow... international Notes customers are no worse off than before, and a darn sight better off against everyone besides Uncle Sam. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

15 24

Re: January 22 Infoworld
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stainles(a)bga.com (Dwight Brown) kindly shared with the group: > >Nicholas Petreley's "Down To the Wire" column is a short take on the >insecurity of encryption schemes used by most commercial software. >There shouldn't be much new here to cypherpunks (he discusses the >vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's >CIS.INI, and uses some out of date examples "to protect the integrity of >current software": bad move, Nicholas), but it'd make a good introduction >for people who aren't familiar with the issues. > >Petreley also announces that InfoWorld is planning a "network-cracking >event", in which they plan to set up various network OS'es, make them as >secure as they can, invite "a small number of accomplished hackers" to >attack them, and publish the results. He says they're looking for >participants... > >InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at >nicholas_petreley(a)infoworld.com. Unfortunately, Petreley's latest article isn't on the Web yet. But it's worth checking out last midweek's column, if only t see Sameer's name. This was only posted online. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQVSWSoZzwIn1bdtAQHMFAGAhQrzSNtsRsv79f9dTKeLDb1eYB5NHUHT ZJHY+unUNYCOhrJpxa0FRrQU8CxEKNV9 =zWhM -----END PGP SIGNATURE-----

1 0

re: [local] Report on Portland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:40 PM 1/23/96 -0500, Weld Pond wrote: > >>There was a key signing. It was a bit rough as for many of us it was our >>first key signing. (I think Neal was the only person who had been to an >>organized key signing.) Still, it went fairly well. Only a couple of >>people brought their key fingerprints on disk instead of paper. As of >>today, I have only recieved signed keys back from a couple of people >>though... The next key signing will be done a bit differently. (Live and >>learn.) There was also a suggestion for a nym signing at some point. > >This begs the question, "How would you conduct an efficient key signing >given what you have learned?" I am in the process of organizing one and >would like to get input as to the best way that this should take place. >Should people bring key fingerprints and public keys on floppy? Would it >be nice to be online and grab public keys off of a key server? How would >you conduct a nym signing? The things that I learned was that instructions should be sent to the participants well in advance. Key fingerprints should be brought on paper becuase it is not always assured of having a computer there to read the disk. (We had a lap top that was refusing to read disks effectivly. We had to use on of the Habit's computers.) Distributing the keys on disk worked well. (I also brought PGP and various tools for those who did not have them.) With the key server there is still an issue of verifying that the key is valid. Best to have the key fingerprint on paper, where it can be read to the group. We also found that reading the first half of the fingerprint was more than attiquite and saved a great deal of time. (Which was later wasted on getting keys off of disks.) I will also be distributing batch files for those dos users who are not familiar with how to sign keys and creating extra keyrings. Most of the problems were procedural rather than technical. It went well for a first run... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

IMC Resolving Email Security Complexity Workshop
by abarrett＠ee.net 17 Dec '03

17 Dec '03

Found this in the box the other day - thought it might be of interest, esp regarding secure email standards. Warmest regards, AJ <---- Begin Forwarded Message ----> Return-Path: dcrocker(a)brandenburg.com Date: Tue, 23 Jan 1996 10:20:50 -0800 To: (potential attendees) From: Dave Crocker <dcrocker(a)brandenburg.com> Subject: IMC Resolving Email Security Complexity Workshop This is a query of your interest in participating in a working meeting. As an initial activity of the newly-formed Internet Mail Consortium, we are hoping to use the coincident timing of EMail World in San Jose and the ISOC Security Conference in San Diego to call for an all-day meeting on the matter of email security. (If you aren't familiar with the IMC, please check out info(a)imc.org or <http://www.imc.org/>.) This note is intended as a pre-announcement and a solicitation for feedback concerning your interest. We'd like to get a sense of the number and range of folks who might/can/will attend. We do not yet have logistics or finances fully worked out, but the timing pressure is tight enough to warrant this letter before the official announcement. Comments about the activity and, especially, an indication of availability, willingness, and (best of all) intention to attend would be highly welcome. Please pass this note on to others who you think are (or should be) interested in email security. Specifics As its first activity, the Internet Mail Consortium proposes to organize a one-day workshop to consider the problem of multiple MIME-based security mechanisms. This is a complicated topic with a long and painful history, but the previous pain is insignificant when compared to what is emerging for vendors and, worse still, for users. Our proposal is to conduct an open meeting with attendance by principals and others involved in this area of work. We will invite the key contributors and solicit additional attendance by vendors, providers, users, and technologists who are concerned with email security. The attendance goal is to have a critical mass of those with the technical expertise and industry involvement to review and debate the requirements, capabilities, and possibilities. The work goal is to seek common ground for a common solution. While we are not overly hopeful that the end of the day will see peace and resolve among the masses, we do hope for a large amount of improved understanding and some amount of convergence. With luck, there will even be improvement in the clarity of constituency for the different technical choices -- that is, a strengthening of the political base for some of the alternatives. We would like to hold the event: Wednesday, 21 February 8:30 am - 5:30 pm (all day) (Near) EMail World event, San Jose Convention Center, CA. This is the last day of EMail World and the day before a two-day ISOC Security conference in San Diego. We propose to structure the meeting with a tight agenda, having a very focused sequence of work on the problem; this is definitely not for general education. Some amount of review is appropriate, but not much. Attendees will be expected to be knowledgeable in the basic technologies, so that only general systems design and specific algorithm choices need to be cited. To help everyone prepare, the Internet Mail Consortium will organize a set of mail-response and Web pages with references and summaries of the current technologies, and will establish a mailing list for exchanges leading up to the meeting. Proposed Agenda Morning Brief descriptions of the candidate solutions Review of the functional and technical requirements Review the extent to which each alternative satisfies the requirements Seek consensus about the requirements Afternoon Haggle about the strengths and weaknesses of the technical alternatives Explore the choices and/or negotiate a preferred solution Those who have worked on this topic in the IETF are quite tired of the whole situation, but the unfortunate reality is that the current product and user choices are quite problematic. We need to continue seeking a viable service. We expect to charge $50 per person, to cover basic costs. I should have more details about this next week. Please do let us know your comments. Thanks! d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com <---- End Forwarded Message ----> __________________________________________________________________ Out the buffer, | PGP encrypted e-mail preferred. Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0X457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but 'Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

Philip Zimmermann and the Press
by Perry E. Metzger 17 Dec '03

17 Dec '03

I contacted Phil about the neo-Nazi attribution in the British press. He has apparently contacted the newspaper and it appears that they are probably going to print an article retracting their statement. I've asked him to comment here but I don't know if he will. Perry

1 0

Re: The Collapse of Ideas in a Pop Culture
by jim bell 17 Dec '03

17 Dec '03

At 10:50 AM 1/23/96 -0800, Simon Spero wrote: >On Tue, 23 Jan 1996, Scott Staedeli wrote: > >> >> I _am_ a GEnXer, and I worshipped Jules Bergmann as a child. Some >> of my first memories is pressing my nose up to the tv, watching Saturn >> V's lifting off. If I ever win the lottery, I'm going to take the Saturn that's > >Bollocks. If you can remember Saturn Vs taking off before reruns, you're >too old! > >Simon (27th July 1969, nearly called Neil) In 1975, I lived in a small suburb of Kansas City, and went with my grandfather from Kansas City Airport on a chartered Boeing 747 to see the Apollo part of the Apollo/Soyuz rocket "blast off". (the whole thing was arranged my a local group of bigwigs, I think.) ( I think it was a Saturn V, but correct me if I'm wrong. I was young and impressionable.) First and last large rocket I saw go in person; I was sincerely impressed; it was extremely LOUD and we were kept MILES away on a grandstand. (But we were the closest you could get, as I understand it, as we were invited guests of the whole thing.) Incidentally, flying on the same airplane from Kansas City were: 1. Susan Ford, daughter of President Gerald Ford. 2. Dr. Werner Von Braun. ob crypto: Uh, none, sorry.

1 0

re: [local] Report on Portland Cpunks meeting
by Weld Pond 17 Dec '03

17 Dec '03

>There was a key signing. It was a bit rough as for many of us it was our >first key signing. (I think Neal was the only person who had been to an >organized key signing.) Still, it went fairly well. Only a couple of >people brought their key fingerprints on disk instead of paper. As of >today, I have only recieved signed keys back from a couple of people >though... The next key signing will be done a bit differently. (Live and >learn.) There was also a suggestion for a nym signing at some point. This begs the question, "How would you conduct an efficient key signing given what you have learned?" I am in the process of organizing one and would like to get input as to the best way that this should take place. Should people bring key fingerprints and public keys on floppy? Would it be nice to be online and grab public keys off of a key server? How would you conduct a nym signing? Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

3 2

Re: IPSEC == end of firewalls
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At least maybe I can avoid Perry's wrath for an off topic post :-). At 15:01 1/23/96 -0500, Perry E. Metzger wrote: >You can't "firewall" every machine -- the act is meaningless. A >Firewall is a filter designed to protect you from bugs in the setup or >implementation of the software on the machines on the inside. What >would it mean for a machine to have "firewall software" in the >operating system? Systems already attempt to prevent unauthorized >access -- the reason you have firewalls is because that software is >sometimes buggy. "Firewall software" in the OS is a meaningless >concept. > >Perry I agree that firewalling every machine would be extreemly difficult with Unix based systems (including MSDOS and MacOS) because so many usefull hacker tools are available from root and everyone has access to root. With systems that provide better isolation, it becomes possible to dedicate the network interface to the protection domain which is running the firewall code. You also need to divide up the administration so the direct user does not break that isolation. BTW, IBM's VM/370 (and successors) has good isolation and could probably perform in this role. Other systems such as KeyKOS (http://www.webcom.com/~agorics/) and EROS (http://www.cis.upenn.edu/~eros) certainly could. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

re: [local] Report on Portland Cpunks meeting
by jim bell 17 Dec '03

17 Dec '03

At 04:26 PM 1/23/96 -0800, Alan Olsen wrote: >>This begs the question, "How would you conduct an efficient key signing >>given what you have learned?" I am in the process of organizing one and >>would like to get input as to the best way that this should take place. >>Should people bring key fingerprints and public keys on floppy? Would it >>be nice to be online and grab public keys off of a key server? How would >>you conduct a nym signing? > >The things that I learned was that instructions should be sent to the >participants well in advance. > >Key fingerprints should be brought on paper becuase it is not always assured >of having a computer there to read the disk. (We had a lap top that was >refusing to read disks effectivly. We had to use on of the Habit's >computers.) ...which, of course, had been infected the night before by a black-bag job by some NSA operatives with a "fiddle with PGP and make the key signatures come out wrong" virus... <G!> Paranoia strikes deep...

1 0

Re: CDA Yes Votes; Collection
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Feb 09, 1996 05:56:13, 'Duncan Frissell <frissell(a)panix.com>' wrote: > >If you are deeply upset by the high-handed manner in which the legislature >has screwed around with your life, welcome to the club. Every bill they >pass and every regulation upsets someone just as badly as you are upset. >That is why some of us want less legislation and less regulation to minimize >just this sort of human suffering. Maybe next time those of you who are >into "proactive" government will think before you crush other people's lives. > >DCF > Isn't it the libertarian types on the list who are into mass killings of civilians with nukes and the "socialist statists" who tend to oppose it? How does this square with your view that it is people into "'proactive' government" who are "crush[ing] other people's lives?" It seems to me having your city nuked is a tad more likely to produce the crushing. Normally, I would not be the first to post this onto cypherpunks, but since *you* did I'm game for another seemingly off-topic discussion. --tallpaul

1 0