- cypherpunks-legacy@lists.ogf.org

SMTP, PINE, and security
by greg＠ideath.goldenbear.com 12 Jul '93

12 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- me <uunet!Cloud.Cuckoo.Land!root> writes: > One of the many neat features of PINE is that it allows one to talk > to the SMTP server _directly_, bypassing sendmail (and its security checks). > What this means is that instead of doing a "telnet xxxx smtp", you can > build and configure a PINE client to do it for you, and retain all the > nice features. PINE source code is freely available, and does not require > root privs to run (any more than it requires root privs to "telnet xxx smtp") [stuff deleted] > If that happens, the days of EZ phreaking are over..... I dunno; if things change such that it's considered normal for users to connect to local or outside SMTP and NNTP ports, that would seem to create an convenient smokescreen/excuse for folks who use those ports for their own (non-approved) ends. It'll be a lot harder to look through a log for unknown connections. See the discussion on comp.dcom.telecom about how difficult it is to provide authentication of cellular phones and fraud prevention, while allowing people to buy new phones easily, roam, and do all of that other stuff that people do. I think the SMTP/NNTP/PINE/whatever stuff is very similar - I think it may prove so difficult to truly authenticate unknown and untraceable users that people will turn to other means for identifying a few trusted machines/people/processes. Public-key crypto, perhaps? :) Security and convenience are basically incompatible; I'm hoping that we opt for convenience. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEEIfn3YhjZY3fMNAQGVfwQAoestrAnd168C061KVqb+znRBFNoAIS1k Ic7JtsVxzj9xaFc5v5nKDUgHD4g47ulTyc1jqEFKmUjfqfal5xZVhN+/4wHFaN0v 2gNbYByvd7/QL685+lkGGkFr1ff7qTdWqVk5LV6b4fRyhJcTHIH48x/55QO0Oo3y DYdA6GDuChk= =SOFw -----END PGP SIGNATURE----- -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

2 1

Re: anonymous mail
by dmandl＠lehman.com 12 Jul '93

12 Jul '93

> From: jet(a)nas.nasa.gov (J. Eric Townsend) > > nobody(a)entropy.linet.org writes: > > that somebody can get fired for views expressed in a private > > e-list, which probably extrapolates to USENET posting as well. > > Apparently, Mr. Steshenko forgot to include the "disclaimer: my > > opinions" with his email. > > Apparently, Mr. Steshenko thought it was appropriate to use company > resources for non-company activities. On top of that, those > activities misrepresented the company. > > Steshenko's firing is something all the libertarians on this list > should applaud. This "libertarian" (note small "l"--if you mean "Libertarian," you should be more careful in the future) doesn't "applaud" Mr. S's firing. What a stupid thing to say. You should either be fried by your more humane Libertarian colleagues, or (if there is general agreement with your message), you should be declared the Missing Link that some of us have been searching for for years. This is so typical. If the State had pulled something like this, you'd be screaming your head off, but when a "private" corporation does it, you not only don't protest, but actually cheer them on? This is just the kind of rigid, stupid, pro-authoritarian thinking that many people expect from the more zomboid Libs, though we rarely get to see anyone display it so candidly. Looking at your email address, I notice that you're an employee of mine. I strongly disapprove of your using this ID for your own leisure activities. However, I'm a nice guy, so I'll give you, oh, two more chances. Then, you're out of here. Direct all flames anywhere but dmandl(a)panix.com or dmandl(a)lehman.com. --Dave.

2 1

please send cypherpunk mail to me at
by nate＠VIS.ColoState.EDU 12 Jul '93

12 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Please send the CP mail to me at nate(a)vangogh.vis.colostate.edu I am having problems getting the CP mail forwarded to me, and this may very well help. thanks, - -nate +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger me at nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | "I have but one single desire - to tear down the sky" -A. Toomba +----------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEGIb9Tgi1fmrpxlAQFMOwP9Gq8DUzldiPDSfRRrlBCjRKBAyXU9fZ8z 6wOBelKJqVNHwgDBOMDkgKWe0iSwANT1/yJ0szcOZmERT9pod75HGzHtDogNGyfL 4ZjrqVCtAA95Y+HnyTfGQ7Ej86NEqRaN8F+hE7ZqwurtCYBf3Ag0jES4iI/YvjbN bSPpjSPItPA= =PkJT -----END PGP SIGNATURE-----

1 0

Help! not getting any CypherPunk mail!
by nate＠VIS.ColoState.EDU 12 Jul '93

12 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Help! I am not getting any mail from the CypherPunks mailing list, although my posts are apparently getting through OK. Please help! thanks, - -nate sammons +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger me at nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | "I have but one single desire - to tear down the sky" -A. Toomba +----------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEFtRtTgi1fmrpxlAQFzyAP8C6V9nVURq13bPYPa+FPnCFiYc71wAKKI o+t1HGdcylMuY24lKk+UhI2yEMO/JEyqDYJnpeOV6kn+izfx4OyrWLVmN7rYD4Nf Yr8wb18+3Zd9cFPsn6QwSLzd/2XVY+tmzrIMwVShmgIAl2gobuScey+q7JBK3j8X ImzeUJF20Hw= =Y2eB -----END PGP SIGNATURE-----

1 0

Re: Radical Paranoia?
by dmandl＠lehman.com 12 Jul '93

12 Jul '93

> From: J. Michael Diehl <mdiehl(a)triton.unm.edu> > > Lets say someone emails me a key and the return address matches that of > the address in the key. Do I assume no one is spoofing me? You have to > admit that this is possible albeit unlikely. What good is key certification > if it only "probably valid?" I've noticed that many of the keys on the > server are signed with the same person's key. I doubt that these people > have had physical contact with each of the people who's key that they've > signed. Am I just being paranoid, or is there a valid issue here? I > welcome any of your comments. Anything is possible. It's best to play it VERY safe when it comes to certifying or accepting keys. The ideal thing is to accept only keys that have been signed by a key you know to be good. Start with a key that's been handed to you personally (or that you are absolutely certain is legit), and work from there. Some folks (bless them) have signed oodles of keys and are very trustworthy; if you can work through the web to them eventually (being careful along the way about who you trust as a certifier), you'll eventually have a windfall. No, most people on the public servers have probably not met face to face; they've worked their way to each other using trusted signatures and certifiers. Just be careful about who you trust. --Dave.

1 0

"Data Haven" def
by edgar＠spectrx.Saigon.COM 12 Jul '93

12 Jul '93

Patrick E. Hykkonen Inquired: Could someone please define a 'data haven'? I understand digitial cash, it is exactly what it sounds like. However, in the context I've heard data haven used in, then there is much more than simply keeping one's data encrypted on your local hard drive. Webster's Seventh New Coll. Dict.: Haven: 1: HARBOR, PORT 2: A place of safety :ASYLUM My analysis: A "data haven" is some entity where data can be placed and have some assurance against either accidental or deliberate destruction. Encrypted data on your hard disk is safe enough against -disclosure-, but is very vulnerable to destruction, either accidental or deliberate. Certain individuals and governments have such strong views on certain forms of data that they will destroy them if they even suspect encryption is hiding such data. A data haven would ensure such data could not be destroyed without permission of its owner. The owner might or might not permit distribution of the data either free or for a fee. Examples of data at risk for deliberate destruction: Pornography, especially child ponography. According to recent news, a BBS in Denmark (Holland?) may be a data haven for that. Politically incorrect programs. For example, the German government is trying (and may have succeeded) to destroy all copies of a game program called "Concentration Camp Commander". This was on the news a few months ago. The USA would be a data haven for this program, generally speaking, since as political speach it would be protected by the First Amendment. (But I don't know if any copies have ever made it here; I net-chat with a few people in Europe & none of them have ever heard of it.) -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Radical Paranoia?
by wcs＠anchor.ho.att.com 12 Jul '93

12 Jul '93

Email is *not* enough. Easily forged, easily intercepted, not secure. This mail could be coming from me, it could be coming from the NSA, it could be my cat jumping on my keyboard's function keys triggering emacs form-letter-mode. No way to tell. Cat already dumped my password and modem dialcodes into this mail message, and he's still pretty young :-) Building and maintaining a web of trust means we're all responsible for signing keys carefully, and making sure people know how careful our signatures are. Read through the READMEs a couple more times until you really understand the procedures! My view is that you should only sign a key if you really *know* that the person whose key your signing is that person and you've verified with them that you've got the right key. If somebody *you recognize* hands you their key, fine - I recognize about 10 or so well-known cypherpunks that I could do this with (plus other people who might be interested but aren't verbose contributors here :-) On the other hand, if Vesselin Bontchev asked me to sign his key, I wouldn't do it, because I don't know him by sight, unless somebody I know knows him personally introduced us. If somebody you know by *voice* wants you to sign their key, you'd better at least have a voice telephone call with them where you read key fingerprints over the phone. This is how I had Phil sign my key, and there are 3-4 others here I could probably do this with if I wanted. When you're adding people to your PGP keyring, pgp asks you how well you trust people to sign keys. You can trust me to do that much for identifying people, but on the other hand I've got a diskless workstation as the only thing I have that can do PGP until I get it on my wife's laptop, so you can't trust that my keyring hasn't been hacked -- that's why my pgp userid says "multiuser" in it. I really won't feel comfortable signing keys until I've got a secure system and we've got an RSAREF implementation that makes use of RSA kosher. If you're likely to sign keys for people you don't really know well, such as giving out starter PGP floppies at a trade show or rave or something, I suppose you could generate a separate key/userid that says it's not very secure, signed by your regular key, but do try to at least check easily-forged ID like driver's licenses for people you don't know, and encourage them to generate real keys and get them signed by people that *they* really know. It's not ideal; do people feel that's acceptable to get people initial connections? Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

RE: Radical Paranoia?
by Paul Goggin 12 Jul '93

12 Jul '93

>Lets say someone emails me a key and the return address matches that of >the address in the key. Do I assume no one is spoofing me? You have to >admit that this is possible albeit unlikely. What good is key certification >if it only "probably valid?" I've noticed that many of the keys on the >server are signed with the same person's key. I doubt that these people >have had physical contact with each of the people who's key that they've >signed. Am I just being paranoid, or is there a valid issue here? I >welcome any of your comments. I understand your precaution and problem very well. I have had similar fears. Recently, I was in similar situation recently. I wanted to exchange keys with someone I have met only once. The situation as it arose actually ended up working okay. We exchanged keys after encrypting them with the normal encryption option, with a password being someone at the place we meet. Knowledge common to only a few select people. Then we started a talk session at a prescribed time at the relevant addresses and tried to rely on information specific dialogue to verify one's person as the one in question. Without physically being there this seems like at least a little extra security. As to the broader question you are really asking on verification I am unsure on how it can be solved. Obviously my situation was unique that we had met and could decide on an information basis, that would seemingly be hard to duplicate, but this is not always available. Paul -- R O All Comments Copyright by | Technofetisht A N Paul S. Goggin (1993) | Cypher, Cyber, Chaos V Information Broker | Ergoflux, Interzone E chaos(a)aql.gatech.edu | Carpe Diem: Stop the Clipper wiretap chip Finger account for latest _Phrack_ | Public Key: PGP and RIPEM available For anonymous communication:---> anonymus+4744(a)charcoal.com ------------------------------------------------------------------------------ Title 18 USC 2511 and 18 USC 2703 Protected -- Monitoring Absolutely Forbidden

1 0

Radical Paranoia?
by J. Michael Diehl 12 Jul '93

12 Jul '93

I'm having a philisophical problem reguarding when to sign someone else's public key. Obviously, if you watch someone generate a key, and they physicaly hand you a copy of it, you should sign it. Fortunately, life has been this good to me about 5 times. But what if life isn't so good? Lets say someone emails me a key and the return address matches that of the address in the key. Do I assume no one is spoofing me? You have to admit that this is possible albeit unlikely. What good is key certification if it only "probably valid?" I've noticed that many of the keys on the server are signed with the same person's key. I doubt that these people have had physical contact with each of the people who's key that they've signed. Am I just being paranoid, or is there a valid issue here? I welcome any of your comments. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

REMAILER: really anon?
by wmo＠rebma.rebma.mn.org 12 Jul '93

12 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- > > 9: remailer(a)rebma.mn.org (this reply took almost 3+ days!) > > From: nobody(a)rebma.rebma.mn.org > Remailed-By: Mr. Nobody <remailer(a)rebma.mn.org> A little background on my remailer... My machine is connected to the net at large via UUCP... And I only have one phone line at home, which me and the family share with the computer. So it only polls out for mail when we're asleep (22:30 CDT - 7:30 CDT). And, I'll admit, when the weather gets ugly enough here in Minnesota, the machine gets powered down to keep the place cooler. That's the disadvantage of the remailer at rebma. The advantage is that since I own the machine, the remailer will stay in operation, period. (I think my service provider does have a clause in the agreement that mentions that use that prevents other users from getting service will not be tolerated, but that's it.) So, if you're looking for fast turnaround time, remailer(a)rebma.mn.org is not for you. If a long delay can be used as an advantage, more power to you. - -Bill -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLD8NHRiQVHeOVJ+HAQF5AwP9HmELtb3xCOo79cxT5UpBdIiM8mJmT0D0 Fiacai6jxzZxGeq6mSgco96IgR8V3M57EJ66788v8I+vwPsuKoRS7ESgKyF7ijqn b1AfCEgh3VJfEUmPFg3Ulmg6LtDCQ5EkYEFcrhdKHqa9edvm3xVFexodKwOPDzhL tbTkxzdyiIk= =cPEm -----END PGP SIGNATURE-----

1 0