- cypherpunks-legacy@lists.ogf.org

PEM vs. PGP formats
by remail＠tamsun.tamu.edu 03 Sep '93

03 Sep '93

> On the other hand, in terms of anonymity, you can always generate a > self-signed key with TIS/PEM (I forget the exact term they use in the > TIS/PEM docs, but you can just make yourself a certificate which > doesn't really say anything about your identity). Yes, but this doesn't provide the service I desire. I *want* to be able to sign a message, but I *only* want the intended recipient to know who I am. PEM discloses the originator's ID *in the clear* when I send a signed message. PGP hides the signature and all other information that identifies me within the encrypted portion of the message!

1 0

programmer's lot
by Andy Wilson 03 Sep '93

03 Sep '93

[forwards deleted] >>From New Scientist, 28 august 93, Feedback column: >> >>"The National Westminster Bank admitted last month that it keeps >> personal information about its customers-such as their political >> affiliation-on computer. But now Computer Weekly reveals that a >> financial institution, sadly unnamed, has gone one better and moved >> into the realm of personal abuse. >> The institution decided to mailshot 2000 of its richest customers, >> inviting them to buy extra services. One of its computer programmers >> wrote a program to search through its databases and select its >> customers automatically. He tested the program with an imaginary >> customer called Rich Bastard. >> Unfortunately, an error resulted in all 2000 letters being addressed >> "Dear Rich Bastard". The luckless programmer was subsequently sacked."

1 0

UK Privacy International Co
by Dave Banisar 03 Sep '93

03 Sep '93

UK Privacy International Conference ANNOUNCEMENT ONE DAY PUBLIC CONFERENCE INTERNATIONAL DEVELOPMENTS IN PRIVACY AND DATA PROTECTION 30th SEPTEMBER, 1993, MANCHESTER, UK A roundtable hosted jointly by Privacy International and the Law School of the University of Manchester Topics include : Privacy concerns with Caller ID and digital phone services Privacy implications of Electronic Health Care Patient Record Systems and medical smart cards Cryptography, and communications surveillance Implications of the European Commission data protection directive The establishment of guidelines for handling police files in emerging democracies in Central and Eastern Europe Weaknesses in the UK Data Protection Act This programme will include a small number of papers and formal presentations, but will primarily be a forum for general discussion of the issues. A number of key international experts will be present at the meeting. The conference is free for all Privacy International members, independent experts, and privacy and consumer advocates. A fee of 50 (US$75) will apply to representatives of government organisations or companies. 8.30 AM - 2.00 PM, Thursday 30th September 1993 Room 2.22, The Law School, University of Manchester, Oxford Road, Manchester, M13 9PL For more information, please contact : Simon Davies at Privacy International in London on (44) 81 402 0737 or fax (44) 81 313 3726 (email : Davies @privint.demon.co.uk ) or Dave Banisar at Privacy International in Washington on (1) 202 544 9240, fax (1) 202 547 5482 (email : Banisar(a)washofc.cpsr.org )

1 0

WANTED: List of very reliable remailers
by nobody＠eli-remailer 03 Sep '93

03 Sep '93

-----BEGIN PGP SIGNED MESSAGE----- I've been experimenting with the remailers lately, and I've been trying to put together all the tools I'll need to start sending most of my email through them. Towards this end, I wrote a simple program called CRM that adds forwarding tags, and calls PGP to do multiple encryptions, and then wraps the result in a /bin/sh script that will extract the cyphertext and do the mailing. In what is starting to look to me like a design flaw, I set the program up to pick a random chain of a specified length out of a set of remailers. All of this talk about remailer reliability has got me a little bit spooked, because I don't have any way of knowing if my mail is going through or not. I'd like to configure my remailer's utility so that it only uses a small list of *very* reliable remailers, preferably with each entry on the list being run by a distinct person. Are there any remailers which: o Support PGP encryption? o Have been in reliable operation for a significant period of time (at least a couple of months)? o Are maintained by someone who knows enough about the software to prevent it from crashing? o Don't introduce significant delays in the remailing? (Unless, of course, they are using some sort of scheme to frustrate traffic analysis.) and o Are set up on systems over which the remailer's administrator has enough clout to prevent a summary shutdown without at least giving a couple of days' notice? I'm assuming (for no very good reason) that Hal Finney's sites fit these criterium. If that's true, then strictly speaking, I'd only need one other similar site run by another person, although I'd feel better if I was using a chain through three remailers. Obviously, the more remailers I have on the list, the better off I am. But I'd rather have a small list of highly reliable remailers than a larger list than contains even a single marginal one. The list of remailers that I'm using now came from a list that was posted to this mail-list a few days ago, and I haven't had any problems with it (at least none that I know of -- I'm assuming that all of my mail went through). I just got a little worried about the post reporting dropped mail from the jarthur remailer administrator, which had been mentioned on the list I had been using as a reliable remailer. If anyone can help me out, I'd be grateful. Please post replies to the list, or mail me directly at: astrashe(a)nyx.cs.du.edu Thanks, Alex -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLIejerGKvmrRrQghAQHvMQQA1Ez5Lxo1glHaJhvquvuti1WseFl4Nw5r g0qRfeWQFwSbZZtsFUiGs6f4iibj9lVpBwtmL8k7oTYRfCNLe+noi6TC0PChEeHt BKQmCAGTx5oPu2UtqXUvfFtb2MwqDXxNpX4BOd+klO6qPjBq6H8eG7GCNzSmeLp5 yr3ALw+qANg= =FSf4 -----END PGP SIGNATURE-----

1 0

Re: where can I get the source for BSD mail?
by jim＠tadpole.com 03 Sep '93

03 Sep '93

Oh, several places. Look for the source to metamail (ask archie, or fish around on bellcore.com) and there is typically a 'tahoe.tar.Z' file around. Jim

1 0

PGP features
by edgar＠spectrx.Saigon.COM 03 Sep '93

03 Sep '93

Brad Huntting recently posted: Perhaps it's time we polished the edges, added a few of the features that are lacking, and wrote up up an RFC for the PGP message format. Some features I'd like to see in PGP are: I've added my comments [with these full margins] as appropriate. The ability to send an encrypted message to multiple recipients without duplicating the entire message. The most logical way to do this would probably be to encrypt the random IDEA key once for each recipient. ??? This has been implemented in PGP since at least release 2.2. (Maybe 2.1, memory fails). Just specify multiple UserID fragments in the command line when encrypting. Note that if you don't specify a UserID in the command line, you -cannot- enter multiple ID's in the resulting prompt. This is in the -h help text: To encrypt a message for any number of multiple recipients: pgp -e textfile userid1 userid2 userid3 There needs to be a facility for having multiple signatures on a single document without making the signers sign each others signatures. Besides the obvious application of removing a signature from a document, this would also facilitate things like petitions where many people could asynchronously sign a single document, and latter assemble all the signatures together. This can be done via detached signature certificates, which can be gathered together and presented with the original document. To create a signature certificate that is detached from the document: pgp -sb textfile [-u your_userid] It should be possible (though certainly not mandatory) to hide the recipient's identity entirely. Not currently implemented, but being discussed. You can acheive much the same effect by using a another key-pair with a pseudonym in the UserID, to be distributed only through remailers or otherwise anonymously. The message format needs to allow for alternate forms of encryption (besides IDEA). Furthermore, the (shared key) algorithm used to encrypt a message should be hidden in the RSA encrypted part of the message along with the shared key. Ideally, a list of algorithms could be given which would allow the message to be optionally compressed before being encrypted, or encrypted two or more times with different algorithms. Not implemented, but has been mentioned. Triple-DES is one possible alternative. You can achieve multiple IDEA encryption by just using current PGP to encrypt twice (or more). Even if you encrypt to the same public key, the IDEA key used will be different. Compression can currently be turned off, if desired, via a CONFIG.TXT option, which can also be specified in the command line. Compression is also automatically turned off if the plaintext is recognized as the output of PKZIP or other popular compressors. If I'm confused and the PGP message format already supports some of these features, please correct me. Consider yourself corrected (:} -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

where can I get the source for BSD mail?
by an23135＠anon.penet.fi 03 Sep '93

03 Sep '93

I am looking for a copy of the source for BSD mail. Can anyone help me? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Crypto Greetings from Russia
by mbriceno＠aol.com 03 Sep '93

03 Sep '93

> Whooaa! Slow.... > > Please remember that the former SU is full of "companies" that claim > to be *the* whatever national initiative of Russia. Mostly they are > just a couple of former research scientists with a Grand Plan, and > usually they have no clue as to how to make it fly. They just think > that with the new market echonomy, simply forming a company and > having some Big Words will make them filty rich automatically... > > I know there are exceptions. But.. Beware. Thanks for telling me. I was not aware of that. However, they claim to have equipped quite a number of sites. I haved asked them for more info on their products. Let's see what they got. --Marc

2 1

Re: NY tax on info services (whatever that means)
by baumbach＠atmel.com 03 Sep '93

03 Sep '93

I have been studying the US constitution lately, and an excerpt from Article 1 Section 10 seems appropriate: No State shall, without the Consent of the Congress, lay any Imposts or Duties on Imports or Exports, except what may be absolutely necessary for executing its inspection Laws; and the net Produce of all Duties and Imposts, laid by any State on Imports or Exports, shall be for the Use of the Treasury of the Unites States; and all such Laws shall be subject to the Revision and Control of the Congress. In liberty, Peter Baumbach

1 0

NY tax on info services (whatever that means)
by Jason Zions 03 Sep '93

03 Sep '93

>I was sloppy in stating the test for a Commerce Clause problem with this >law. Hopefully this is a bit more accurate: > - First ask, Does this law affect interstate commerce? How and > to what extent? > - Then ask, Does the law burden interstate commerce in any way? > - Next, Does the law have a discrete benefit to State (ie NY State) > interests? > - Finally, does the benefit to NY interest outweigh the burden on > interstate commerce? Is the state interest more significant? If you read the text of the tax change, you'll find that it subjects no new services to taxation, it merely changes the tax rate they pay. This particular law does not increase the burden on any businesses other than how much tax they must collect; they already had to collect some, now they have to collect more. The specific tasks they had to perform stay the same, just some numbers get larger. You'd have to find and attack the original tax code changes that imposed taxes of any sort on comm-based info services. Good luck; probably NY just imposed a tax on all commerce where at least one party had nexus in NY, which swallowed up comm-based info services along with everyone else. Jason

1 0