Re: strong authentication without strong crypto?

1999-02-08 Thread Tom Wu
Christopher Nielsen writes: > > On Thu, 4 Feb 1999, Christopher Nielsen wrote: > > > On Thu, 4 Feb 1999, David R. Conrad wrote: > > > > > Quick question: does anyone know of technology or techniques that would > > > facilitate strong authentication (_not_ encryption) for unattended high > > >

Re: PGP compromised on Windows 9x?

1999-02-08 Thread Nelson Minar
Forgive me for saying this, but I'm a bit dismayed at the arrogance of people talking about "idiots" and "stupid" and "fools". People using cryptography on computers are generally not stupid. If they are having a hard time with passphrases, I humbly suggest it is because we as cryptographers and s

mixmaster && the DNS

1999-02-08 Thread Russell Nelson
Hmmm Anybody thought of combining mixmaster, an SMTP client, SMTP server, and the DNS? Here's how it would work: 1) email would arrive at the SMTP client using ordinary means. 2) The SMTP client would ask the DNS for the MX records for the host. 3) If the DNS has two MX records which poin

Re: PGP compromised on Windows 9x?

1999-02-08 Thread Steve Bellovin
> But what you imply, that PGP (and other programs that request passwords > and passphrases from the user) should be more picky in what it accepts, is > an excellent idea. Of course, it's impossible to force the user to choose > a good passphrase, but requiring no fewer than, say, 12 characters t

Possible Security Problem: Fake PGP Key

1999-02-08 Thread Ben Laurie
It has come to my attention that there is a faked key out there, purporting to be mine: Key ID: 0x6B722A59 Fingerprint: 428C 1E68 35E1 E96C 177A F49C A906 3F1F 6B72 2A59 Name: Ben Laurie <[EMAIL PROTECTED]> Created: 09/10/98 Type: 2048/1024 DH/DSS It isn't clear to me what the point of this key

RE: PGP compromised on Windows 9x?

1999-02-08 Thread David R. Conrad
On Mon, 8 Feb 1999, Tom Garner wrote: > I say that it is TIME for programmers to QUIT giving us ... the > opportunity to choose a passphrase that can be easily guessed > Isn't it possible w/out degrading any further on PGP's side the ability to > have someone enter a passphrase and its eithe

RE: PGP compromised on Windows 9x?

1999-02-08 Thread Walter Burton
> -Original Message- > From: Jay D. Dyson [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 08, 1999 12:08 PM > To: Cryptography List > Subject: RE: PGP compromised on Windows 9x? > > > -BEGIN PGP SIGNED MESSAGE- > > On Mon, 8 Feb 1999, Tom Garner wrote: > > Sure, I wou

Re: PGP compromised on Windows 9x?

1999-02-08 Thread Michael Motyka
> Cryptography can be rendered easy to use (a'la NAI's iteration of > PGP which functions as several things, not the least of which is a plug-in > for the Eudora mailer). The only problem is this: when you make something > idiot-proof, idiots will use it. And when idiots use something, i

Re: quantum cryptanalysis

1999-02-08 Thread Michael Motyka
Your theory "feels" correct but in one of the more popular real world scenarios the $resource$ ratio for the cracker to the encryptor could be as high as 10^5 or 10^6 : 1. Mike bram wrote: > > On Fri, 5 Feb 1999, bram wrote: > > > I have a theory that no matter what computing machine is availa

Re: PGP compromised on Windows 9x?

1999-02-08 Thread Alan Olsen
On Feb 4, 6:50pm, Harald Hanche-Olsen wrote: > Subject: Re: PGP compromised on Windows 9x? > As is pointed out in the referenced article, this macro virus only > steals the (encrypted) private keyring, and hence private keys are > still safe unless the attacker can break the encryption. Which he

Re: PGP compromised on Windows 9x?

1999-02-08 Thread Michael J. Fromberger
quoth Tom Garner: > Greetings/Salutations, > > It troubles me, how lazy and stupid the average person is. How many TIMES > do we have to say "don't use a passphrase that is..." or "make your > passphrase 8 ALPHA-Numeric...". > > I say that it is TIME for programmers to QUIT giving us (and I say

DCSB: Jonathan Rusch, USDOJ; Internet Fraud and the Future of Digital Commerce

1999-02-08 Thread Robert Hettinga
--- begin forwarded text Date: Mon, 8 Feb 1999 08:20:48 -0500 To: [EMAIL PROTECTED], [EMAIL PROTECTED] From: Robert Hettinga <[EMAIL PROTECTED]> Subject: DCSB: Jonathan Rusch, USDOJ; Internet Fraud and the Future of Digital Commerce Cc: "Jonathan J. Rusch" <[EMAIL PROTECTED]> Sender: [EMAIL PR

linux-ipsec: Re: 1des inclusion NOT!

1999-02-08 Thread Robert Hettinga
--- begin forwarded text To: Linux IPsec <[EMAIL PROTECTED]>, [EMAIL PROTECTED] Subject: linux-ipsec: Re: 1des inclusion NOT! Date: Sun, 07 Feb 1999 21:57:41 -0800 From: John Gilmore <[EMAIL PROTECTED]> Sender: [EMAIL PROTECTED] People have been bandying about various claims about the security

RE: PGP compromised on Windows 9x?

1999-02-08 Thread Tom Garner
Greetings/Salutations, It troubles me, how lazy and stupid the average person is. How many TIMES do we have to say "don't use a passphrase that is..." or "make your passphrase 8 ALPHA-Numeric...". I say that it is TIME for programmers to QUIT giving us (and I say us, as in all of us), the oppor