Snake Oil on the Water...

[Rich Burroughs]

At 11:19 AM 6/16/96 -0700, Alan Olsen wrote:
>I recieved this on another list.  

Me too :)

>The snake oil is starting to flow pretty heavy.  I expect it to get worse...

Here's the reply I sent to that list.  I cc'd the person who sent the
original message...

===========

At 01:00 PM 6/16/96 -0400, Joe Horn <6mysmesa at 1eagle1.com> wrote:
[snip]
>At the following two sites, you may download the FREEWARE Pegasus Mail
>program version 2.3.3 16 bit for windows 3.x or a version for WIN95.

I like Pmail.  Had I not been an experienced Eudora user before I
tried it (and pretty stuck on the Eudora interface) I would have
probably stuck with it.  Kudos to the Pegasus team for releasing
a freeware program with such excellent filtering capabilites.  It
is much more of a full-fledged program than Eudora Lite, IMHO.

> The
>unique thing about it, besides its simplicity and that it's a great mail
>program better than Eudora, it has a built in encryption program that is as
>effective as PGP and lots simpler. All you do is agree on a password with
>your correspondent. That simple.

This would seem to eliminate the immense benefit of public key
encryption -- that you can send encrypted email to someone you
haven't met, without any prior communication.  If you have
security concerns, they will probably apply to whatever
communication media that you would use to agree on the password.
If I have a secure method to agree on a password with someone,
what the heck do I need crypto for?  ;)

Also, I'm assuming that you can only send encrypted mail to
other Pmail users.  PGP is above those kinds of limitations --
it can be used on many platforms and with many different types
of email packages.

> The encryption program and the mail program
>were developed in New Zealand, and were legally imported, so the encryption
>program is better than PGP, which is regulated by Federal Cypher Laws.

This is misleading, IMHO.

While the export of the US version is "regulated by Federal
Cypher Laws," PGP is not like some products which export a
weaker version to accomodate ITAR.  The version of PGP for people
outside of the US is developed outside of the US, and is just
as strong as the domestic version, AFAIK.

Some people's lives, business, etc. depend on what type of
crypto they use.  I don't think it's really appropriate to make
misleading claims like the one above when the stakes are that
high.

Please drop this claim for your promotional efforts, or back
it up with specific evidence showing how ITAR has weakened
PGP.

>Honest.Plus, it's free. The sites are:
[snip]

For those people who want to use PGP with Pegasus, there's a
nice little plug-in for Pegasus called PGP JN, by John Navas,
which allows you to choose to encrypt with PGP (you need to
have a copy) instead of the Pmail crypto.  It has a few small
drawbacks, IMHO, but I found it much easier to use than PGP
shell interfaces that require cutting text to the clipboard 
first.

John's program is available at:
http://www.aimnet.com/~jnavas/winpmail.html

I really think the Pegasus team would do better to mention
that John's program is available, rather than try to steer
people away from PGP.  PGP JN makes using the basic email
features of PGP more streamlined than most other mail
packages I've used (except Private Idaho, which is not a
full-fledged email package).  I think it would be better to
mention that both options exist, rather than seeking to
convert the masses away from PGP, which is unlikely to
succeed anyway, IMHO.

PC users who use PGP should try Pegasus and PGP JN.

Private Idaho is available from Joel McNamara's page, at:
http://www.eskimo.com/~joelm/


Rich

______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
U.S. State Censorship Page at - http://www.teleport.com/~richieb/state
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause