PGP on an e-commerce site

2000-01-03 Thread Dan Geer
My daughter was ordering a CD this evening from the site cdnow.com and I noted that besides the SSL option they also had a PGP option. Take a look at http://www.cdnow.com/cgi-bin/mserver/SID=0/pagename=/RP/HELP/order.html#8q This is new to me. --dan

DeCSS Court Hearing Report

2000-01-03 Thread Lucky Green
Today, I attended a fascinating hearing in State of California Superior Court (county of Santa Clara). The issue at bar was a request by the "DVD Copy Control Association, Inc." (DVDCCA) to issue a temporary restraining order (TRO) against various named and unnamed operators of websites and other

Re: DeCSS Court Hearing Report

2000-01-03 Thread Ted Lemon
The only reason that justifies the existence of the player keys in the CSS scheme is control of the DVD consortium over the licensees: they can always threaten to revoke the player key of a given licensee if that licensee doesn't play by the rules (Macrovision, Region Codes, etc.). Now

Re: rate of finding collisions

2000-01-03 Thread David Wagner
In article [EMAIL PROTECTED], Paul Crowley [EMAIL PROTECTED] wrote: [EMAIL PROTECTED] (Ian Goldberg) writes: The expected number of collisions you get if you sample S items out of a universe of size U (=2^N in the above case) is about (S^2)/U. I know this is a month old but I'm only now

Re: DeCSS Court Hearing Report

2000-01-03 Thread Ray Hirschfeld
Date: Wed, 29 Dec 1999 20:06:32 -0800 From: Lucky Green [EMAIL PROTECTED] First, basing the litigation on trade secret seems sub-optimal. Not that a different legal argument would be anywhere near compelling, but it appears that an argument based on copyright would have been a better

Re: DeCSS Court Hearing Report

2000-01-03 Thread Ray Hirschfeld
From: Andreas Bogk [EMAIL PROTECTED] Date: 01 Jan 2000 22:37:18 -0500 Is it just me, or did the DVDCCA not exist when DeCSS was released? I've never heard of them, and when I tried to obtain a CSS license, the information I had was that CSS is licensed by some japanese company (which by

DCSB: EFF DeCSS Case Fund-Raiser -- Speakers Wanted

2000-01-03 Thread R. A. Hettinga
-BEGIN PGP SIGNED MESSAGE- I just got email from Warren Agin, of Swiggart and Agin, this afternoon. Swiggart and Agin has offered to be the first partial sponsor of the EFF fundraiser we've been kicking around on the DCSB list recently, a direct result of discussions on the cypherpunks

Re: DeCSS Court Hearing Report

2000-01-03 Thread bram
On Mon, 3 Jan 2000, Ray Hirschfeld wrote: Date: Wed, 29 Dec 1999 20:06:32 -0800 From: Lucky Green [EMAIL PROTECTED] but it appears that an argument based on copyright would have been a better approach. I conjecture they did it this way because the prohibition against circumventing

Re: PGP on an e-commerce site

2000-01-03 Thread Enzo Michelangeli
FirstEcom.com's secure credit card payment gateway, designed by myself, uses (on top of SSL) OpenPGP for DSA signature and symmetric encryption of certain pieces of data. No WoT or PKI are used: only bilateral public key exchanges between FirstEcom and each merchant site, with out-of-band

Re: PGP on an e-commerce site

2000-01-03 Thread William H. Geiger III
In [EMAIL PROTECTED], on 01/03/00 at 11:46 PM, bram [EMAIL PROTECTED] said: On Mon, 3 Jan 2000, Dave Del Torto wrote: Here the plot thickens: If the only two sigs on the key at CDNOW are the key-owner's sig and David's, then the ability of any CDNOW customer to trust the key's security

Re: PGP on an e-commerce site

2000-01-03 Thread Dave Del Torto
At 10:46 pm -0500 2000-01-01, Dan Geer wrote: My daughter was ordering a CD this evening from the site cdnow.com and I noted that besides the SSL option they also had a PGP option. Take a look at http://www.cdnow.com/cgi-bin/mserver/SID=0/pagename=/RP/HELP/order.html#8q This is new to me.

Seven and a Half Nonrisks of PKI

2000-01-03 Thread Ben Laurie
I've been debating whether to ditch this or not, but I feel it needs to be said. So, as the Duke of Wellington may, or may not, have said, "publish, and be damned". Cheers, Ben. . Seven and a Half Non-risks of PKI: What You Shouldn't Be Told about Public

Re: PGP on an e-commerce site

2000-01-03 Thread bram
On Mon, 3 Jan 2000, Dave Del Torto wrote: Here the plot thickens: If the only two sigs on the key at CDNOW are the key-owner's sig and David's, then the ability of any CDNOW customer to trust the key's security is based on David's "trustability quotient" as well as the ability of CDNOW to